What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Bman, Bman1, & Others Have Invaded My Pc

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,

Current symptoms are… when I reboot, BMAN and BMAN1 are started on task manager.
When I open firefox or IE, website is 'not found'. I tried using my VPN and it failed because it could not find my security configuration.

I have installed and updated to current my norton AV. I have used AD-AWARE and SPYBOT S&D, and at one point CWSHREDDER. I have tried to clean up as much but I lost my internet access in the process. I'm going to have to flip back and forth (home pc to work pc) to get this fixed (I hope). I need help… :(

Here is my Hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 5:10:56 PM, on 4/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\mHotkey.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe
C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\System32\lxamsp32.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\rnlkma.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Guest\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [IMwire] C:\WINDOWS\System32\imwireup.exe
O4 - HKLM\..\Run: [w32S3qX] cal18030.exe
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdt.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\rnlkma.exe
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [rhqtvrm] c:\windows\system32\rhqtvrm.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitedfg32.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [jrhgvnd] c:\windows\system32\zgfvka.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [h0t2Rkb3V] c_i2dvaa.exe
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://clbchma01.ci.long-beach.ca.us/iNotes.cab
O16 - DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/2003…iTunesSetup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D68B82D-C79F-4FFC-83C0-8D0FC794CEF2} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} (alaGrid.TechDocSearch) - file://C:\WinBackup\WIN2000\CONTENT\cabs\alaGrid.CAB
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Thanks!
Post #2
Please download and run CWShredder. Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

http://www.softpedia.com/get/Internet/Popu…WShredder.shtml

REBOOT


Please download the Microsoft Beta Spyware scanner from the link below. Make sure that you check for updates before you scan. Fix what it finds.

Download here >>>> http://www.microsoft.com/athome/security/s…re/default.mspx



Please do an online scan,

Panda >>> http://www.pandasoftware.com/activescan/co…n_principal.htm

Make sure that you choose "fix" or "clean".

Reboot and post a new HiJackThis log by clicking on "add reply" at the bottom right.
Post #3
Hello SIQQYX, I had success and was able to get by my internet access back after running CWShredder and Microsoft's Antispyware. I tried running the panda software scan referred from your response several times and I couldn't get rid of the 105+ it finds. It says all I can do with it is scan. I eventually found the 'evaluation' version and installed that. However, I believe it is having a problem with Norton running at the same time. My PC would lock up after several minutes. If I pull the plug to my DSL line, I am able to use my PC. I will try and de-install Norton AV and work from there. Do you have other suggestions? Thanks, Raoul
Post #5
Hello Siggyx,

What I did was reboot (safemode) for each occurence of the following: CWShredder, Spybot S&D;, AdAware, Antispyware, Panda Titanium, and finally the HJK log. My PC is still super slow. BTW, I have four users on this machine defined. Thank you very much for your time and help.

Here is the Coolwebsearch log:
**** Run Keys ****

RUN: [SoundMan] SOUNDMAN.EXE
RUN: [CHotkey] mHotkey.exe
RUN: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
RUN: [windows auto update]
RUN: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
RUN: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
RUN: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
RUN: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
RUN: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
RUN: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
RUN: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
RUN: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
RUN: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
RUN: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
RUN: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
RUN: [w32S3qX] cal18030.exe
RUN: [lxamsp32.exe] lxamsp32.exe
RUN: [pdfSaver3]
RUN: [winupdtl] C:\WINDOWS\System32\winupdt.exe
RUN: [KavSvc] C:\WINDOWS\System32\rnlkma.exe
RUN: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
RUN: [rhqtvrm] c:\windows\system32\rhqtvrm.exe
RUN: [etbrun] C:\windows\system32\elitedfg32.exe
RUN: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
RUN: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
RUN: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
RUN: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
RUN: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
RUN: [jrhgvnd] c:\windows\system32\zgfvka.exe
RUN: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
RUN: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
RUN: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
RUN: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
RUN: [h0t2Rkb3V] c_i2dvaa.exe


**** Browser Helper Objects ****

BHO: [] C:\Program Files\Spybot - Search & Destroy\SDHelper.dll


**** IE Toolbars ****

TOOLBAR: []


**** IE Extensions ****

IEExt: [Control Pad] C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
IEExt: [ICQ] C:\Program Files\ICQ\ICQ.exe
IEExt: [AOL Instant Messenger (SM)] C:\Program Files\aim\aim.exe
IEExt: [Real.com] C:\Program Files\aim\aim.exe
IEExt: [MoneySide] C:\Program Files\aim\aim.exe
IEExt: [Messenger] C:\Program Files\Messenger\MSMSGS.EXE


**** Hosts File Entries ****

HOSTS: 127.0.0.1 localhost
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 www.xzoomy.com
HOSTS: 127.0.0.1 advnt01.com
HOSTS: 127.0.0.1 www.advnt01.com
HOSTS: 127.0.0.1 xzoomy.com
HOSTS: 127.0.0.1 www.adwave.com
HOSTS: 127.0.0.1 adwave.com
HOSTS: 127.0.0.1 topconverting.com
HOSTS: 127.0.0.1 www.topconverting.com
HOSTS: 127.0.0.1 www.ntsearch.com
HOSTS: 127.0.0.1 ntsearch.com
HOSTS: 127.0.0.1 www.incredifind.com
HOSTS: 127.0.0.1 incredifind.com
HOSTS: 127.0.0.1 www.popaware.com
HOSTS: 127.0.0.1 popaware.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.smileycentral.com
HOSTS: 127.0.0.1 smileycentral.com
HOSTS: 127.0.0.1 www.cafreedom.com
HOSTS: 127.0.0.1 cafreedom.com
HOSTS: 127.0.0.1 www.revenue.net
HOSTS: 127.0.0.1 revenue.net
HOSTS: 127.0.0.1 www.hotbar.com
HOSTS: 127.0.0.1 hotbar.com
HOSTS: 127.0.0.1 hotbar.com


**** IE Settings ****

Default Page: http://www.emachines.com
Default Search: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
Local Page: C:\WINDOWS\system32\blank.htm
Search Bar:
Search Page: www.google.com


**** IE Context Menu (Right click) ****



**** Layered Service Providers ****

LSP: PAV_LAYERED over [MSAFD Tcpip [TCP/IP]]
LSP: PAV_LAYERED over [MSAFD Tcpip [UDP/IP]]
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{20E13686-8E1B-4455-97A6-428005C8C978}] SEQPACKET 7
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{20E13686-8E1B-4455-97A6-428005C8C978}] DATAGRAM 7
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{329F9D42-81C4-49DF-8B66-9606D1E8B9E8}] SEQPACKET 6
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{329F9D42-81C4-49DF-8B66-9606D1E8B9E8}] DATAGRAM 6
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{718E0E32-DE85-41F3-9D12-95EFA83D294C}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{718E0E32-DE85-41F3-9D12-95EFA83D294C}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{5E1B83A8-C26C-45AE-B278-BCB6F5BBAF99}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{5E1B83A8-C26C-45AE-B278-BCB6F5BBAF99}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8EEBA239-33C4-4BD0-9265-506C4F5E43D8}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8EEBA239-33C4-4BD0-9265-506C4F5E43D8}] DATAGRAM 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C66B5D58-A6B0-477E-A33E-785FFB320E0A}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C66B5D58-A6B0-477E-A33E-785FFB320E0A}] DATAGRAM 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{11B24E0B-5321-4304-8AFB-1AD450778CBA}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{11B24E0B-5321-4304-8AFB-1AD450778CBA}] DATAGRAM 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{6647E14D-FA62-4729-A055-973938C06329}] SEQPACKET 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{6647E14D-FA62-4729-A055-973938C06329}] DATAGRAM 5


**** Blocked Control Panel Items ****

BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No


**** Downloaded Program Files ****

Microsoft XML Parser for Java [file://C:\WINDOWS\Java\classes\xmldso.cab]
{1E2941E3-8E63-11D4-9D5A-00902742D6E0} [https://clbchma01.ci.long-beach.ca.us/iNotes.cab] C:\WINDOWS\System32\msvcrt.dll C:\WINDOWS\Downloaded Program Files\inotes.dll
{2C15848B-21C0-406A-9902-56C8D90684F3} [file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB]
{33564D57-0000-0010-8000-00AA00389B71} [http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB]
{41F17733-B041-4099-A042-B518BB6A408C} [http://a1408.g.akamai.net/7/1408/9955/20031218/akamai.info.apple.com/iTunes4/WW/win/019-0123.20031218.zes4d/iTunesSetup.exe]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} [http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab]
{5D68B82D-C79F-4FFC-83C0-8D0FC794CEF2} [file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB]
{9A9307A0-7DA4-4DAF-B042-5009F29E09E1} [http://www.pandasoftware.com/activescan/as5/asinst.cab]
{AED6797A-D608-11D4-89D2-00105AA3C57F} [file://C:\WinBackup\WIN2000\CONTENT\cabs\alaGrid.CAB]
{D27CDB6E-AE6D-11CF-96B8-444553540000} [http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab]
{D719897A-B07A-4C0C-AEA9-9B663A28DFCB} [http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab]


**** Windows Services ****

[Alerter] %SystemRoot%\System32\svchost.exe -k LocalService
[ALG] %SystemRoot%\System32\alg.exe
[AppMgmt] %SystemRoot%\system32\svchost.exe -k netsvcs
[aspnet_state] %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
[AudioSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[BITS] %SystemRoot%\System32\svchost.exe -k netsvcs
[Browser] %SystemRoot%\System32\svchost.exe -k netsvcs
[ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
[ccPwdSvc] "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"
[ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
[cisvc] C:\WINDOWS\System32\cisvc.exe
[ClipSrv] %SystemRoot%\system32\clipsrv.exe
[COMSysApp] C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
[CryptSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[CVPND] "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe"
[DefWatch] "C:\Program Files\Symantec AntiVirus\DefWatch.exe"
[Dhcp] %SystemRoot%\System32\svchost.exe -k netsvcs
[dmadmin] %SystemRoot%\System32\dmadmin.exe /com
[dmserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[Dnscache] %SystemRoot%\System32\svchost.exe -k NetworkService
[ERSvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[Eventlog] %SystemRoot%\system32\services.exe
[EventSystem] C:\WINDOWS\System32\svchost.exe -k netsvcs
[FastUserSwitchingCompatibility] %SystemRoot%\System32\svchost.exe -k netsvcs
[GEARSecurity] C:\WINDOWS\System32\gearsec.exe
[helpsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[HidServ] %SystemRoot%\System32\svchost.exe -k netsvcs
[HTTPFilter] %SystemRoot%\System32\svchost.exe -k HTTPFilter
[ImapiService] C:\WINDOWS\System32\imapi.exe
[iPodService] C:\Program Files\iPod\bin\iPodService.exe
[lanmanserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[lanmanworkstation] %SystemRoot%\System32\svchost.exe -k netsvcs
[LexBceS] C:\WINDOWS\system32\LEXBCES.EXE
[LmHosts] %SystemRoot%\System32\svchost.exe -k LocalService
[Messenger] %SystemRoot%\System32\svchost.exe -k netsvcs
[mnmsrvc] C:\WINDOWS\System32\mnmsrvc.exe
[MSDTC] C:\WINDOWS\System32\msdtc.exe
[MSIServer] C:\WINDOWS\System32\msiexec.exe /V
[NetDDE] %SystemRoot%\system32\netdde.exe
[NetDDEdsdm] %SystemRoot%\system32\netdde.exe
[Netlogon] %SystemRoot%\System32\lsass.exe
[Netman] %SystemRoot%\System32\svchost.exe -k netsvcs
[Nla] %SystemRoot%\System32\svchost.exe -k netsvcs
[NtLmSsp] %SystemRoot%\System32\lsass.exe
[NtmsSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[PAVFIRES] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe"
[PAVFNSVR] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe"
[Pavkre] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe"
[PavProt] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe"
[PavPrSrv] "C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe"
[PAVSRV] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe"
[PlugPlay] %SystemRoot%\system32\services.exe
[PolicyAgent] %SystemRoot%\System32\lsass.exe
[PREVSRV] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe"
[ProtectedStorage] %SystemRoot%\system32\lsass.exe
[PSIMSVC] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe"
[RasAuto] %SystemRoot%\System32\svchost.exe -k netsvcs
[RasMan] %SystemRoot%\System32\svchost.exe -k netsvcs
[RDSessMgr] C:\WINDOWS\system32\sessmgr.exe
[RemoteAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[RpcLocator] %SystemRoot%\System32\locator.exe
[RpcSs] %SystemRoot%\system32\svchost -k rpcss
[RSVP] %SystemRoot%\System32\rsvp.exe
[SamSs] %SystemRoot%\system32\lsass.exe
[SavRoam] "C:\Program Files\Symantec AntiVirus\SavRoam.exe"
[SCardSvr] %SystemRoot%\System32\SCardSvr.exe
[Schedule] %SystemRoot%\System32\svchost.exe -k netsvcs
[seclogon] %SystemRoot%\System32\svchost.exe -k netsvcs
[SENS] %SystemRoot%\system32\svchost.exe -k netsvcs
[SharedAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[ShellHWDetection] %SystemRoot%\System32\svchost.exe -k netsvcs
[SLService] slserv.exe
[SNDSrvc] "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"
[Spooler] %SystemRoot%\system32\spoolsv.exe
[srservice] %SystemRoot%\System32\svchost.exe -k netsvcs
[SSDPSRV] %SystemRoot%\System32\svchost.exe -k LocalService
[stisvc] %SystemRoot%\System32\svchost.exe -k imgsvc
[SvcProc] C:\WINDOWS\svcproc.exe
[SwPrv] C:\WINDOWS\System32\dllhost.exe /Processid:{6CE6B04A-87CF-4918-BA5D-9158443F856A}
[Symantec AntiVirus] "C:\Program Files\Symantec AntiVirus\Rtvscan.exe"
[SysmonLog] %SystemRoot%\system32\smlogsvc.exe
[TapiSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[TermService] %SystemRoot%\System32\svchost.exe -k netsvcs
[Themes] %SystemRoot%\System32\svchost.exe -k netsvcs
[TrkWks] %SystemRoot%\system32\svchost.exe -k netsvcs
[uploadmgr] %SystemRoot%\System32\svchost.exe -k netsvcs
[upnphost] %SystemRoot%\System32\svchost.exe -k LocalService
[UPS] %SystemRoot%\System32\ups.exe
[VSS] %SystemRoot%\System32\vssvc.exe
[W32Time] %SystemRoot%\System32\svchost.exe -k netsvcs
[WebClient] %SystemRoot%\System32\svchost.exe -k LocalService
[winmgmt] %systemroot%\system32\svchost.exe -k netsvcs
[WmdmPmSN] %SystemRoot%\System32\svchost.exe -k netsvcs
[WmiApSrv] C:\WINDOWS\System32\wbem\wmiapsrv.exe
[wuauserv] %SystemRoot%\system32\svchost.exe -k netsvcs
[WZCSVC] %SystemRoot%\System32\svchost.exe -k netsvcs


**** Custom IE Search Items ****

SEARCH: [SearchAssistant] http://ie.search.msn.com
SEARCH: [CustomizeSearch] http://ie.search.msn.com


**** Complete IE Options ****

IEOPT: [NoUpdateCheck]
IEOPT: [NoJITSetup]
IEOPT: [Disable Script Debugger] yes
IEOPT: [Start Page] http://www.google.com/
IEOPT: [Use Custom Search URL]
IEOPT: [Show_ChannelBand] No
IEOPT: [Anchor Underline] yes
IEOPT: [Cache_Update_Frequency] Once_Per_Session
IEOPT: [Display Inline Images] yes
IEOPT: [Do404Search]
IEOPT: [Local Page] C:\WINDOWS\system32\blank.htm
IEOPT: [Save_Session_History_On_Exit] no
IEOPT: [Show_FullURL] no
IEOPT: [Show_StatusBar] yes
IEOPT: [Show_ToolBar] yes
IEOPT: [Show_URLinStatusBar] yes
IEOPT: [Show_URLToolBar] yes
IEOPT: [Use_DlgBox_Colors] yes
IEOPT: [Search Page] www.google.com
IEOPT: [Check_Associations] yes
IEOPT: [FullScreen] no
IEOPT: [Window_Placement] ,
IEOPT: [Friendly http errors] yes
IEOPT: [NotifyDownloadComplete] yes
IEOPT: [AddToFavoritesExpanded]
IEOPT: [Use FormSuggest] yes
IEOPT: [Save Directory] A:\
IEOPT: [AutoSearch]
IEOPT: [NoSaveAsPOSTWarning]
IEOPT: [Error Dlg Displayed On Every Error] no
IEOPT: [Error Dlg Details Pane Open] no
IEOPT: [Use Search Asst] no
IEOPT: [FormSuggest PW Ask] no
IEOPT: [Search Bar]
IEOPT: [Expand Alt Text] no
IEOPT: [Move System Caret] no
IEOPT: [NscSingleExpand]
IEOPT: [NoWebJITSetup]
IEOPT: [Page_Transitions]
IEOPT: [FavIntelliMenus] no
IEOPT: [Enable Browser Extensions] yes
IEOPT: [UseThemes]
IEOPT: [Force Offscreen Composition]
IEOPT: [AllowWindowReuse]
IEOPT: [ShowGoButton] yes
IEOPT: [SmoothScroll]
IEOPT: [Enable AutoImageResize] yes
IEOPT: [Enable_MyPics_Hoverbar] yes
IEOPT: [Play_Animations] yes
IEOPT: [Play_Background_Sounds] yes
IEOPT: [Display Inline Videos] yes
IEOPT: [Show image placeholders]
IEOPT: [Print_Background] no
IEOPT: [Default_Page_URL] http://www.emachines.com
IEOPT: [Default_Search_URL] http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
IEOPT: [Search Page] www.google.com
IEOPT: [Enable_Disk_Cache] yes
IEOPT: [Cache_Percent_of_Disk]
IEOPT: [Delete_Temp_Files_On_Exit] yes
IEOPT: [Local Page] C:\WINDOWS\system32\blank.htm
IEOPT: [Anchor_Visitation_Horizon]
IEOPT: [Use_Async_DNS] yes
IEOPT: [Placeholder_Width]
IEOPT: [Placeholder_Height]
IEOPT: [Start Page] http://www.google.com/
IEOPT: [CompanyName] Microsoft Corporation
IEOPT: [Custom_Key] MICROSO
IEOPT: [Wizard_Version] 6.0.2524.0000
IEOPT: [FullScreen] no
IEOPT: [Search Bar]
IEOPT: [Enable Browser Extensions] yes
IEOPT: [SearchAssistant]
IEOPT: [IEWatsonEnabled]

Here is the Spybot log:
Ooops! I forgot to copy this. But I did get a list of the bugs deleted.
Media plex, Advertising.com, Avenue A Inc, Doubleclick, DSO Exploit, Hitbox, Target Net, and ValueClick. (It seems like DSO Exploit I can;t get rid of since I re-scanned and it was still there.)

Here is the AdAware log:

Ad-Aware SE Build 1.05
Logfile Created on:Monday, April 18, 2005 6:01:53 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R38 11.04.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Ebates MoneyMaker(TAC index:4):22 total references
MRU List(TAC index:0):28 total references
Tracking Cookie(TAC index:3):19 total references
WindUpdates(TAC index:8):3 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


4-18-2005 6:01:53 PM - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\raoul\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office


MRU List Object Recognized!
Location: : C:\Documents and Settings\raoul\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\windows\currentversion\explorer\runmru
Description : mru list for items opened in start | run


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\search assistant\acmru
Description : list of recent search terms used with the search assistant


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\terminal server client\default
Description : list of recent systems connected to using remote desktop / terminal services


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\office\9.0\common\open find\microsoft word\settings\open\file name mru
Description : list of recent documents opened by microsoft word


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\office\9.0\common\open find\microsoft word\settings\save as\file name mru
Description : list of recent documents saved by microsoft word


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\internet explorer\main
Description : last save directory used in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\microsoft management console\recent file list
Description : list of recent snap-ins used in the microsoft management console


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\mediaplayer\preferences
Description : last cd record path used in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\adobe\acrobat reader\5.0\avgeneral\crecentfiles
Description : list of recently used files in adobe reader


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : software\musicmatch
Description : download location of the musicmatch installer


MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : software\musicmatch\musicmatch jukebox\4.0\mmradio
Description : information on the last station listened to using musicmatch radio


MRU List Object Recognized!
Location: : software\musicmatch\musicmatch jukebox\4.0\fileconv
Description : file conversion location settings in musicmatch jukebox


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


MRU List Object Recognized!
Location: : S-1-5-21-1316817595-2541319435-2214429306-1008\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 168
ThreadCreationTime : 4-19-2005 12:59:56 AM
BasePriority : Normal


#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 216
ThreadCreationTime : 4-19-2005 1:00:10 AM
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 240
ThreadCreationTime : 4-19-2005 1:00:15 AM
BasePriority : High


#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 284
ThreadCreationTime : 4-19-2005 1:00:24 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 296
ThreadCreationTime : 4-19-2005 1:00:24 AM
BasePriority : Normal
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 460
ThreadCreationTime : 4-19-2005 1:00:30 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 532
ThreadCreationTime : 4-19-2005 1:00:35 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 728
ThreadCreationTime : 4-19-2005 1:00:54 AM
BasePriority : Normal
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : EXPLORER.EXE

#:9 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
ProcessID : 828
ThreadCreationTime : 4-19-2005 1:01:16 AM
BasePriority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 28


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment : "AC"
Rootkey : HKEY_USERS
Object : S-1-5-21-1316817595-2541319435-2214429306-1008\software\lq
Value : AC

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 29


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 29


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@revenue[1].txt
Category : Data Miner
Comment : Hits:102
Value : Cookie:[removed]/
Expires : 6-9-2022 10:05:42 PM
LastSync : Hits:102
UseCount : 0
Hits : 102

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@bluestreak[2].txt
Category : Data Miner
Comment : Hits:2
Value : Cookie:[removed]/
Expires : 4-13-2015 9:18:32 PM
LastSync : Hits:2
UseCount : 0
Hits : 2

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@adrevolver[2].txt
Category : Data Miner
Comment : Hits:4
Value : Cookie:[removed]/adrevolver/
Expires : 1-8-2008 9:00:04 PM
LastSync : Hits:4
UseCount : 0
Hits : 4

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : [removed][1].txt
Category : Data Miner
Comment : Hits:47
Value : Cookie:[removed]/
Expires : 4-16-2006 6:51:14 AM
LastSync : Hits:47
UseCount : 0
Hits : 47

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@realmedia[2].txt
Category : Data Miner
Comment : Hits:5
Value : Cookie:[removed]/
Expires : 12-31-2010 5:00:00 PM
LastSync : Hits:5
UseCount : 0
Hits : 5

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@apmebf[2].txt
Category : Data Miner
Comment : Hits:2
Value : Cookie:[removed]/
Expires : 4-15-2010 1:11:02 AM
LastSync : Hits:2
UseCount : 0
Hits : 2

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@2o7[2].txt
Category : Data Miner
Comment : Hits:4
Value : Cookie:[removed]/
Expires : 4-15-2010 4:15:48 PM
LastSync : Hits:4
UseCount : 0
Hits : 4

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@centrport[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:[removed]/
Expires : 12-31-2029 5:00:00 PM
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@zedo[2].txt
Category : Data Miner
Comment : Hits:11
Value : Cookie:[removed]/
Expires : 4-14-2015 1:06:38 AM
LastSync : Hits:11
UseCount : 0
Hits : 11

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@casalemedia[2].txt
Category : Data Miner
Comment : Hits:34
Value : Cookie:[removed]/
Expires : 4-7-2006 2:56:28 AM
LastSync : Hits:34
UseCount : 0
Hits : 34

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@tribalfusion[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:[removed]/
Expires : 12-31-2037 5:00:00 PM
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@0[1].txt
Category : Data Miner
Comment : Hits:5
Value : Cookie:[removed]/HTM/384/0
Expires : 4-16-2006 3:45:10 AM
LastSync : Hits:5
UseCount : 0
Hits : 5

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@fastclick[2].txt
Category : Data Miner
Comment : Hits:43
Value : Cookie:[removed]/
Expires : 4-6-2007 1:08:20 AM
LastSync : Hits:43
UseCount : 0
Hits : 43

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@qksrv[2].txt
Category : Data Miner
Comment : Hits:2
Value : Cookie:[removed]/
Expires : 4-15-2010 1:11:02 AM
LastSync : Hits:2
UseCount : 0
Hits : 2

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@trafficmp[2].txt
Category : Data Miner
Comment : Hits:62
Value : Cookie:[removed]/
Expires : 4-16-2006 5:38:46 AM
LastSync : Hits:62
UseCount : 0
Hits : 62

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@0[2].txt
Category : Data Miner
Comment : Hits:128
Value : Cookie:[removed]/HTM/382/0
Expires : 4-16-2006 6:51:42 AM
LastSync : Hits:128
UseCount : 0
Hits : 128

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@tickle[1].txt
Category : Data Miner
Comment : Hits:12
Value : Cookie:[removed]/
Expires : 4-16-2007 4:14:14 PM
LastSync : Hits:12
UseCount : 0
Hits : 12

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : [removed][1].txt
Category : Data Miner
Comment : Hits:20
Value : Cookie:[removed]/
Expires : 4-17-2005 6:06:14 AM
LastSync : Hits:20
UseCount : 0
Hits : 20

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : raoul@edge.ru4[2].txt
Category : Data Miner
Comment : Hits:2
Value : Cookie:[removed]/
Expires : 4-9-2035 5:58:28 AM
LastSync : Hits:2
UseCount : 0
Hits : 2

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 19
Objects found so far: 48



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

WindUpdates Object Recognized!
Type : File
Data : A0132202.vxd
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP282\



WindUpdates Object Recognized!
Type : File
Data : A0132482.vxd
Category : Malware
Comment :
Object : C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\



WindUpdates Object Recognized!
Type : File
Data : ide21201.vxd
Category : Malware
Comment :
Object : C:\WINDOWS\system32\



Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 51


Scanning Hosts file……
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
463 entries scanned.
New critical objects:0
Objects found so far: 51




Performing conditional scans…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ebates MoneyMaker Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : TM

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : AD

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : AC

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : U

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : I

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : AM

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : AT

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : TR

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : country

E
Post #6
Hello Siggyx,

somehow my reply got cut off. Here's the rest of the info…

…continuation of AdAware log:
Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : city

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : state

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : RX

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : RX2.8

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : RX2.9

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : RX3.0

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : RX3.1

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : RX3.2

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : RX3.3

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : FU3.4

Ebates MoneyMaker Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\lq
Value : FU3.5

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 21
Objects found so far: 72

6:19:45 PM Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:17:52.63
Objects scanned:177252
Objects identified:44
Objects ignored:0
New critical objects:44


Here is the Antispyware log:
Spyware Scan Details
Start Date: 4/18/2005 6:29:52 PM
End Date: 4/18/2005 6:37:00 PM
Total Time: 7 mins 8 secs

Detected Threats

SearchMiracle.EliteBar Browser Plug-in more information…
Details: SearchMiracle.EliteBar adds a search redirection toolbar to Internet Explorer called Elite Bar.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
c:\windows\elitetoolbar\elitetoolbar version 60.dll

Infected folders detected
c:\windows\elitetoolbar


KaZaA Software Bundler more information…
Details: KaAaA is a peer-to-peer file sharing software that displays adware advertising and installs third party adware software on your computer.
Status: Ignored
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected registry keys/values detected
HKEY_CLASSES_ROOT\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2}
HKEY_LOCAL_MACHINE\software\classes\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2} P2P Stack for Joltid Content Distribution Environment
HKEY_LOCAL_MACHINE\software\kazaa
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b0 48319
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b1 0
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b0seconds 396
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\LastEstimate b 5000
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\LastEstimate time 1073760812
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b0 44
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b1 0
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b0seconds 185
HKEY_CLASSES_ROOT\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2}\LocalServer32 C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
HKEY_LOCAL_MACHINE\software\kazaa\CloudLoad ShareDir
HKEY_LOCAL_MACHINE\software\kazaa\ConnectionInfo +
HKEY_LOCAL_MACHINE\software\kazaa\ConnectionInfo
HKEY_LOCAL_MACHINE\software\kazaa\LocalContent +
HKEY_LOCAL_MACHINE\software\kazaa\LocalContent DownloadDir C:\Program Files\KazaaMain\My Shared Folder
HKEY_LOCAL_MACHINE\software\kazaa\LocalContent DatabaseDir C:\Program Files\KazaaMain\Db
HKEY_LOCAL_MACHINE\software\kazaa +
HKEY_LOCAL_MACHINE\software\kazaa Tmp 0
HKEY_LOCAL_MACHINE\software\kazaa ListenPort 3240
HKEY_LOCAL_MACHINE\software\kazaa my_ip_address 4.8.192.161
HKEY_CLASSES_ROOT\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2}\ProgID JCDE_Stack.1
HKEY_LOCAL_MACHINE\software\kazaa UDP_probe_successes -1431655745
HKEY_LOCAL_MACHINE\software\kazaa
HKEY_LOCAL_MACHINE\software\kazaa FirewallStatus 1431655775
HKEY_LOCAL_MACHINE\software\kazaa UDP_receive_status -286331154
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\p2p networking
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\p2p networking
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\p2p networking Changed 0
HKEY_CLASSES_ROOT\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2}\VersionIndependentProgID JCDE_Stack
HKEY_CLASSES_ROOT\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2} P2P Stack for Joltid Content Distribution Environment
HKEY_LOCAL_MACHINE\software\classes\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2}
HKEY_LOCAL_MACHINE\software\classes\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2}\LocalServer32 C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
HKEY_LOCAL_MACHINE\software\classes\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2}\ProgID JCDE_Stack.1
HKEY_LOCAL_MACHINE\software\classes\clsid\{cc7a6223-3759-4075-8cea-971f5cfc0ed2}\VersionIndependentProgID JCDE_Stack


Detected Spyware Cookies
No spyware cookies were found during this scan.

I was successful in running Panda Titanium 2005 and it deleted/disinfected 26 files.
Prominent was Adware/ezula and adware/wintools.

Here is most recent Hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 8:45:36 PM, on 4/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Guest\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [w32S3qX] cal18030.exe
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\rnlkma.exe
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [rhqtvrm] c:\windows\system32\rhqtvrm.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitedfg32.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [jrhgvnd] c:\windows\system32\zgfvka.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [h0t2Rkb3V] c_i2dvaa.exe
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: dtci.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://clbchma01.ci.long-beach.ca.us/iNotes.cab
O16 - DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/2003…iTunesSetup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D68B82D-C79F-4FFC-83C0-8D0FC794CEF2} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} (alaGrid.TechDocSearch) - file://C:\WinBackup\WIN2000\CONTENT\cabs\alaGrid.CAB
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Again, Thanks for your help.
Post #7
Scan with hijackthis and put a check beside these lines and choose FIX R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file) O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file) O4 - HKLM\..\Run: [w32S3qX] cal18030.exe O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\rnlkma.exe O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe O4 - HKLM\..\Run: [rhqtvrm] c:\windows\system32\rhqtvrm.exe O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitedfg32.exe O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe O4 - HKLM\..\Run: [jrhgvnd] c:\windows\system32\zgfvka.exe O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU) Then look fo and delete this folder C:\Program Files\Media Access Reboot and post a new hijackthis log
Post #8
Hello Siggyx,

Here is the latest Hijackthis log (safe mode) after I did as you instructed (FIX all in your list as well as delete the Media Access folder).

Logfile of HijackThis v1.99.1
Scan saved at 4:51:21 PM, on 4/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Guest\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\rnlkma.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [h0t2Rkb3V] c_i2dvaa.exe
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: dtci.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://clbchma01.ci.long-beach.ca.us/iNotes.cab
O16 - DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/2003…iTunesSetup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D68B82D-C79F-4FFC-83C0-8D0FC794CEF2} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} (alaGrid.TechDocSearch) - file://C:\WinBackup\WIN2000\CONTENT\cabs\alaGrid.CAB
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


I have also tried to restart normal mode just to see if there is an improvement and it is still super slow. I am not able to get to the Task Manager to see what is cooking. I did get a panel that is titled - Giant Antispyware Data Service. The text says… The application cannot be completed because the other application is busy. Choose 'SWITCH' to activate the busy application and correct the problem. :oops:

I do not know where that is coming from (Panda Antivirus?) or what to do with the prompt so I'm ignoring it for now. :unsure:

Thank you very much for your help… :)
Post #10
Hello Siggyx, Here's the log… C:\Qoologic\qoologic PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Files Found in system Folder………… ———————— C:\WINDOWS\system32\pav.sig: Qoologic C:\WINDOWS\system32\pav.sig: Qoologic C:\WINDOWS\system32\pav.sig: AsPack Files Found in all users startup Folder………… ———————— Files Found in all users windows Folder………… ———————— Finished Thank you very much. :) :) :)
Post #11
Download MicroWorld virus scan here >>> Micro World http://www.mwti.net/antivirus/free_utilities.asp

To run the virus scan make sure you click the following

memory, registry, startup folders, system folders, services, drive (all drives will be added) then click on scan clean. When the scan is complete hilight all the files in the LOWER box. Then ctrl + c and paste them into the thread ctrl + v.

I warn you the scan will take a long time to run and will not fix anything just identifies bad files.
Post #12
Hello Siggyx, Here's the MWAV log… File System Found infected by "Bargain Buddy Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "BetterInternet Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "mysearch Spyware/Adware" Virus. Action Taken: No Action Taken. File C:\WINDOWS\aymzcmtscy.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\woinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\psis80ex.ax infected by "not-a-virus:AdWare.CashBack.b" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\raoul\LOCALS~1\Temp\i13.tmp infected by "not-a-virus:AdWare.SurfSide.j" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\raoul\LOCALS~1\Temp\WGT\uacupg.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\raoul\LOCALS~1\TEMPOR~1\Content.IE5\KCGQUS8U\thnall1ac[1].htm infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\marc\Local Settings\Temporary Internet Files\Content.IE5\CPA7GTE3\thnall1ac[1].htm infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\raoul\Local Settings\Temp\i13.tmp infected by "not-a-virus:AdWare.SurfSide.j" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\raoul\Local Settings\Temp\WGT\uacupg.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\raoul\Local Settings\Temporary Internet Files\Content.IE5\KCGQUS8U\thnall1ac[1].htm infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\LxkX63\Scan\SETUPX63PART2.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\LexmarkX63\RemoveX63.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\LexmarkX63\X63Twain.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Media Pass\MediaPassC.dll infected by "not-a-virus:AdWare.WinAD.af" Virus. Action Taken: No Action Taken. File C:\Program Files\Microsoft AntiSpyware\Quarantine\52E82581-7F68-4C3A-8200-C72224\F68CE225-574B-4074-908F-F55B11 infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Program Files\Microsoft AntiSpyware\Quarantine\9A56CEC9-9A2E-4E1C-8639-7B1C12\EC3F3CC2-A5BD-4C32-A651-065091 infected by "not-a-virus:AdWare.ToolBar.HotSearchBar.d" Virus. Action Taken: No Action Taken. File C:\Program Files\Mozilla Firefox\extensions\{2bafa858-4ff3-4207-822e-ef46d1b431de}\chrome\isearch.jar infected by "not-a-virus:AdWare.ToolBar.ISearch.e" Virus. Action Taken: No Action Taken. File C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll infected by "not-a-virus:AdWare.ToolBar.Ucmore.a" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-1316817595-2541319435-2214429306-1008\Dc44\MediaAccC.dll infected by "not-a-virus:AdWare.WinAD.ag" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-1316817595-2541319435-2214429306-1008\Dc44\MediaAccess.exe infected by "not-a-virus:AdWare.WinAD.af" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP278\A0125866.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.af" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP278\A0125868.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP278\A0125869.vxd infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP278\A0126845.exe infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129914.exe infected by "not-a-virus:AdWare.SurfSide.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129915.dll infected by "not-a-virus:AdWare.SurfSide.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129916.dll infected by "not-a-virus:AdWare.SurfSide.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129921.dll infected by "not-a-virus:AdWare.EZula.x" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129922.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129924.dll infected by "not-a-virus:AdWare.EZula.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129928.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129933.exe infected by "not-a-virus:AdWare.EZula.aw" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129935.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129936.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129938.exe infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129939.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129940.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129941.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129943.EXE infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129944.EXE infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129947.EXE infected by "not-a-virus:AdWare.VirtualBouncer" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129948.exe infected by "not-a-virus:AdWare.VirtualBouncer.i" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129949.exe infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129976.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129977.exe infected by "not-a-virus:AdWare.EZula.ap" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129978.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129979.exe infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129981.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129982.dll infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129983.exe infected by "not-a-virus:AdWare.CashBack.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129984.exe infected by "not-a-virus:AdWare.CashBack.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129985.exe infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129986.exe infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129987.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129988.srg infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129990.vxd infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0130002.dll infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0130003.dll infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0130004.dll infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0130005.dll infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132218.EXE infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132219.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132220.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132231.exe infected by "Trojan-Dropper.Win32.Small.mr" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132237.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132238.exe infected by "not-a-virus:AdWare.WebRebates.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132239.exe infected by "not-a-virus:AdWare.VirtualBouncer.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132250.dll infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132474.exe infected by "Trojan.Win32.Stervis.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132475.exe infected by "Trojan-Downloader.Win32.Agent.jq" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132476.exe infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132477.exe infected by "Trojan-Dropper.Win32.Small.wc" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132478.dll infected by "Trojan-Clicker.Win32.Small.et" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132479.cpl infected by "Trojan-Dropper.Win32.Small.wc" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132481.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132493.dll infected by "Trojan-Clicker.Win32.Small.ez" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153597.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.af" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153606.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153615.dll infected by "not-a-virus:AdWare.Toolbar.Ucmore" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153616.exe infected by "not-a-virus:AdWare.Wintol.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153617.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176710.exe infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176711.exe infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176712.exe infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176713.dll infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176716.exe infected by "not-a-virus:AdWare.Searcher.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176718.exe infected by "not-a-virus:AdWare.Searcher.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176721.exe infected by "not-a-virus:AdWare.ToolBar.BrowserVillage.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176722.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176724.dll infected by "Trojan-Clicker.Win32.Delf.r" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176725.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176726.exe infected by "not-a-virus:AdWare.WinAD.ai" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176727.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176728.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176729.EXE infected by "not-a-virus:AdWare.SurfSide.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176730.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176731.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176732.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176733.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176734.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176735.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176736.dll infected by "not-a-virus:AdWare.ToolBar.HotSearchBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176741.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176742.exe infected by "Trojan-Downloader.Win32.Small.akz" Virus. Action Taken: No Action Taken. File C:\WINDOWS\aymzcmtscy.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\Cache\Advtg.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\Cache\pop.exe infected by "not-a-virus:AdWare.WinAD.ab" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\Cache\trafficgen-fran.exe infected by "not-a-virus:AdWare.ToolBar.HotSearchBar.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\Cache\ucmoreiex.exe infected by "not-a-virus:AdWare.ToolBar.Ucmore.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\psis80ex.ax infected by "not-a-virus:AdWare.CashBack.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\woinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. *************** Again, thank you very much. :)
Post #13
Not as bad as it seems.

Download CCleaner from the link below and click on rum cleaner.

Download >>>> http://www.majorgeeks.com/download4191.html

Then boot to safe mode (tap f8 while bios loads) and delete these files

C:\WINDOWS\aymzcmtscy.exe
C:\WINDOWS\woinstall.exe
C:\WINDOWS\System32\psis80ex.ax
C:\Program Files\Media Pass\MediaPassC.dll
C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
C:\WINDOWS\system32\Cache\Advtg.exe
File C:\WINDOWS\system32\Cache\pop.exe
File C:\WINDOWS\system32\Cache\trafficgen-fran.exe
File C:\WINDOWS\system32\Cache\ucmoreiex.exe
File C:\WINDOWS\woinstall.exe

Also delete these folders

C:\Program Files\Media Pass
C:\Program Files\TheSearchAccelerator

Then reboot and a new log please.

We will clean up your system restore when we are done.
Post #14
Hello Siggyx,

Here my new hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 5:22:57 PM, on 4/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Guest\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O15 - Trusted Zone: *.hotmail.com
O15 - Trusted Zone: *.masstimes.org
O15 - Trusted Zone: *.sigalert.com
O15 - Trusted Zone: *.uiuc.edu
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://clbchma01.ci.long-beach.ca.us/iNotes.cab
O16 - DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/2003…iTunesSetup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D68B82D-C79F-4FFC-83C0-8D0FC794CEF2} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} (alaGrid.TechDocSearch) - file://C:\WinBackup\WIN2000\CONTENT\cabs\alaGrid.CAB
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

++++++++
I found every item except file C:\WINDOWS\woinstall.exe. I did a search and it could not be found. I think this is a dup of the first one. Other than that, everything went fine. Thank you for your help. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI