Hi:
Please find the logs attached.
I cannot find the F2 - REG: system.ini: Shell=Exploer.exe C:\WINDOWS\NAIL.exe from the HijackThis, but I found NAIL>EXE-00088443.pf under C:\WINDOWS\Prefetch.
Thanks.
Yuzhu
Ewido Scan log
***************************
———————————————————
ewido security suite - Scan report
———————————————————
+ Created on: 11:01:52 PM, 5/23/2005
+ Report-Checksum: A0535469
+ Date of database: 5/24/2005
+ Version of scan engine: v3.0
+ Duration: 73 min
+ Scanned Files: 96042
+ Speed: 21.81 Files/Second
+ Infected files: 276
+ Removed files: 275
+ Files put in quarantine: 0
+ Files that could not be opened: 0
+ Files that could not be cleaned: 1
+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes
+ Scanned items:
C:\
+ Scan result:
C:\!Submit\A0003730.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003743.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003766.exe -> TrojanDownloader.Intexp.c -> Cleaned without backup
C:\!Submit\A0003778.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003788.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003796.exe -> TrojanDropper.Agent.hl -> Cleaned without backup
C:\!Submit\A0003797.exe -> TrojanDownloader.Agent.hw -> Cleaned without backup
C:\!Submit\A0003801.exe -> TrojanDownloader.Apropo.ab -> Cleaned without backup
C:\!Submit\A0003819.exe -> TrojanDownloader.VB.eu -> Cleaned without backup
C:\!Submit\A0003884.exe -> TrojanDownloader.Intexp.c -> Cleaned without backup
C:\!Submit\A0003902.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003922.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003977.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003978.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003989.dll -> Trojan.Agent.db -> Cleaned without backup
C:\!Submit\A0003997.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\A0003998.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\aurora[1].exe -> Spyware.BetterInternet.c -> Cleaned without backup
C:\!Submit\Bztqjm.exe -> Spyware.DealHelper.ac -> Cleaned without backup
C:\!Submit\common.dll -> Spyware.WebSearch.aj -> Cleaned without backup
C:\!Submit\cxtpls_loader.exe -> TrojanDownloader.Apropo.ab -> Cleaned without backup
C:\!Submit\DrPMon[1].dll -> Trojan.Agent.db -> Cleaned without backup
C:\!Submit\exp.exe -> TrojanDownloader.Small.abd -> Cleaned without backup
C:\!Submit\main.exe -> TrojanDownloader.Agent.hw -> Cleaned without backup
C:\!Submit\mtrslib2[1].js -> TrojanDownloader.Small.ag -> Cleaned without backup
C:\!Submit\Poller[1].exe -> Trojan.Agent.cp -> Cleaned without backup
C:\!Submit\ppq82.tmp -> TrojanDownloader.Intexp.c -> Cleaned without backup
C:\!Submit\protector[1].exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\!Submit\ps1.exe -> Spyware.Pacer.a -> Cleaned without backup
C:\!Submit\searchbar.exe -> TrojanDownloader.VB.eu -> Cleaned without backup
C:\!Submit\Smkago.exe -> Trojan.Popmon.a -> Cleaned without backup
C:\!Submit\svcproc.exe -> Trojan.Stervis.c -> Cleaned without backup
C:\!Submit\svcproc[1].exe -> Trojan.Stervis.c -> Cleaned without backup
C:\!Submit\wintask.exe -> TrojanDownloader.Small.abd -> Cleaned without backup
C:\!Submit\wrapperouter.exe -> TrojanDropper.Agent.hl -> Cleaned without backup
C:\!Submit\WSup.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\!Submit\WToolsA.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\!Submit\WToolsB.dll -> Spyware.Wintol.y -> Cleaned without backup
C:\!Submit\WToolsS.exe -> TrojanDownloader.Wintool.f -> Cleaned without backup
C:\!Submit\wupdt.exe -> TrojanDownloader.Intexp.c -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\aurora[1].exe -> Spyware.BetterInternet.c -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Bztqjm.exe -> Spyware.DealHelper.ac -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\common.dll -> Spyware.WebSearch.aj -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Cookies\lily [removed][1].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Cookies\lily [removed][2].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Cookies\lily [removed][1].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Cookies\lily [removed][1].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Cookies\lily cheng@exitexchange[1].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Cookies\lily cheng@p[1].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Cookies\lily cheng@realmedia[1].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\DrPMon.dll -> Trojan.Agent.db -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\exp.exe -> TrojanDownloader.Small.abd -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temp\QCM\aurareco.exe -> Spyware.BetterInternet.f -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\6HA4KKY3\downloaddll[1].htm -> Spyware.DealHelper.ab -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\6HA4KKY3\dun[1].exe -> Spyware.DealHelper.x -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\6HA4KKY3\protector[1].exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\8L8N4Z4R\svcproc[1].exe -> Trojan.Stervis.c -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\8ODGUBP7\DrPMon[1].dll -> Trojan.Agent.db -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\CHQV81AV\pcs_0015[1].exe -> Spyware.Pacer.b -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\CN6LONYX\download[1].htm -> Trojan.Popmon.a -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\DJ3UEBU3\Nail[1].exe -> Trojan.Nail -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\TCC31HKL\fwbar2_main2[1].dll -> Spyware.CoolBar.a -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\UD3CXSV2\mtrslib2[1].js -> TrojanDownloader.Small.ag -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Local Settings\Temporary Internet Files\Content.IE5\UD3CXSV2\version[1].exe -> Spyware.DealHelper.ac -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\ps1.exe -> Spyware.Pacer.a -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\Smkago.exe -> Trojan.Popmon.a -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\wintask.exe -> TrojanDownloader.Small.abd -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\WSup.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\WToolsA.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\WToolsB.dll -> Spyware.Wintol.y -> Cleaned without backup
C:\Documents and Settings\Lily Cheng\WToolsS.exe -> TrojanDownloader.Wintool.f -> Cleaned without backup
C:\Documents and Settings\Yuzhu Zhu\Cookies\yuzhu zhu@adknowledge[1].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Yuzhu Zhu\Cookies\yuzhu [removed][2].txt -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Documents and Settings\Yuzhu Zhu\Local Settings\Temporary Internet Files\Content.IE5\3O4YTK0H\fwbar2_main2[1].dll -> Spyware.CoolBar.a -> Cleaned without backup
C:\Documents and Settings\Yuzhu Zhu\Local Settings\Temporary Internet Files\Content.IE5\7I1917PQ\version[1].exe -> Spyware.DealHelper.ac -> Cleaned without backup
C:\Documents and Settings\Yuzhu Zhu\Local Settings\Temporary Internet Files\Content.IE5\XR7QYN44\protector[1].exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\HijackThis\backups\backup-20050523-192201-192.dll -> Spyware.EliteBar.af -> Cleaned without backup
C:\HijackThis\backups\backup-20050523-192201-934.dll -> Spyware.Wintol.y -> Cleaned without backup
C:\Program Files\Common Files\WinTools\WSup.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\Program Files\Common Files\WinTools\WToolsB.dll -> Spyware.Wintol.y -> Cleaned without backup
C:\Program Files\Toolbar\common.dll -> Spyware.WebSearch.aj -> Cleaned without backup
C:\Program Files\Toolbar\gykhxlmu.rmr -> Spyware.IBISToolbar -> Cleaned without backup
C:\Program Files\Toolbar\PIB.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\Program Files\Toolbar\xlmurin.wzg -> Spyware.IBISToolbar -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\20050521165303.zip/WINDOWS/NDNuninstall6_22.exe -> Spyware.NewDotNet -> Error during cleaning
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq83.tmp -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq84.tmp -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq86.tmp -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq87.tmp -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq88.tmp -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqA4.tmp -> Spyware.ImiBar.d -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqBB.tmp -> Spyware.VirtualBouncer.i -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqBC.tmp\VirtualBouncer.exe -> Spyware.VirtualBouncer.i -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC1.tmp\EECH1.bsx -> Spyware.BookedSpace -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC1.tmp\SPZ3.bsx -> Spyware.BookedSpace -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCF.tmp -> Spyware.Apropos -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE8.tmp -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqEA.tmp -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqEB.tmp -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqEC.tmp -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqEE.tmp -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF0.tmp -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF1.tmp -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF3.tmp -> Spyware.Tracking-Cookie -> Cleaned without backup
C:\RECYCLER\S-1-5-21-1492477701-2804734736-417748510-1007\Dc10.exe -> Trojan.Nail -> Cleaned without backup
C:\RECYCLER\S-1-5-21-1492477701-2804734736-417748510-1007\Dc11.exe -> Trojan.Nail -> Cleaned without backup
C:\RECYCLER\S-1-5-21-1492477701-2804734736-417748510-1007\Dc12.exe -> Trojan.AproposAd -> Cleaned without backup
C:\RECYCLER\S-1-5-21-1492477701-2804734736-417748510-1007\Dc9.exe -> Trojan.Nail -> Cleaned without backup
C:\sysfwb\7299543556\iefwbar.dll -> Spyware.CoolBar.a -> Cleaned without backup
C:\sysfwb\8326517315\iefwbar.dll -> Spyware.CoolBar.a -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003721.exe -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003722.dll -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003723.exe -> Spyware.VirtualBouncer.i -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003729.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003731.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003735.exe -> Trojan.Imiserv.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003742.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003744.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003748.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003774.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003775.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003790.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003791.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003793.exe -> Trojan.Imiserv.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003794.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003800.exe -> TrojanDownloader.Wintool.e -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003810.dll -> Spyware.BookedSpace.e -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP116\A0003811.dll -> Spyware.EliteBar.af -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003878.EXE -> Spyware.VirtualBouncer.j -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003879.EXE -> Spyware.VirtualBouncer.j -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003880.EXE -> Spyware.VirtualBouncer -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003885.dll -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003886.exe -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003887.dll -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003888.dll -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003889.dll -> Spyware.VirtualBouncer.g -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003898.dll -> Spyware.ImiBar.d -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003899.exe -> Spyware.Apropos -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003900.exe -> Spyware.NewDotNet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003904.exe -> Trojan.AproposAd -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003905.exe -> Spyware.VirtualBouncer.i -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003910.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003915.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003926.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003976.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003979.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003984.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003987.exe -> Trojan.Imiserv.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003996.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0003999.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004007.exe -> Trojan.Stervis.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004008.exe -> Trojan.Nail -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004012.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004013.exe -> TrojanDownloader.Small.abd -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004014.exe -> Spyware.Pacer.a -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004015.exe -> TrojanDownloader.Small.abd -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004016.exe -> Spyware.DealHelper.ac -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004017.exe -> Trojan.Popmon.a -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004018.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004026.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004027.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004028.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004030.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004038.dll -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004039.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004041.exe -> TrojanDownloader.Wintool.f -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004043.exe -> TrojanDownloader.Intexp.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004044.exe -> Trojan.Stervis.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004045.exe -> TrojanDownloader.Apropo.ab -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004048.exe -> TrojanDownloader.Agent.hw -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004050.exe -> TrojanDropper.Agent.hl -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004052.dll -> Trojan.Agent.db -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004053.exe -> TrojanDownloader.VB.eu -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004063.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004064.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004065.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004068.exe -> Trojan.Nail -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004069.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004078.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004079.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004081.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004082.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004098.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004099.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004100.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004101.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004109.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004110.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004112.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP118\A0004115.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0006068.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0006071.exe -> Trojan.AproposAd -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0006072.exe -> Trojan.AproposAd -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0006457.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0006458.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0006474.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0006481.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0006483.dll -> Spyware.ImiBar.d -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0006486.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0006506.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006510.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006514.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006515.exe -> Trojan.Imiserv.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006517.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006524.exe -> Spyware.Apropos -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006534.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006535.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006536.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006541.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006572.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006573.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006574.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0006578.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006634.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006635.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006636.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006641.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006670.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006672.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006675.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006676.exe -> Trojan.Imiserv.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006677.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006708.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006709.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006711.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006713.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006730.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006732.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006733.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006742.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006744.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006745.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006748.dll -> Spyware.EliteBar.af -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006761.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006762.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006764.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006773.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006775.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006776.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006785.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006786.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006788.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006792.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006801.exe -> Trojan.Stervis.c -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006802.exe -> TrojanDownloader.Wintool.f -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006804.exe -> Spyware.Wintol.y -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006810.exe -> Trojan.Nail -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006811.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006812.exe -> Trojan.Agent.cp -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006813.exe -> Trojan.AproposAd -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006815.dll -> Trojan.Agent.db -> Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0006816.exe -> Spyware.WebSearch.aj -> Cleaned without backup
C:\WINDOWS\cfgmgr51.dll -> Spyware.BookedSpace -> Cleaned without backup
C:\WINDOWS\cfgmgr52\EECH1.bsx -> Spyware.BookedSpace -> Cleaned without backup
C:\WINDOWS\cfgmgr52\SPZ3.bsx -> Spyware.BookedSpace -> Cleaned without backup
C:\WINDOWS\cfgmgr52.dll -> Spyware.BookedSpace.e -> Cleaned without backup
C:\WINDOWS\jzxskrsf.exe -> Spyware.BookedSpace.e -> Cleaned without backup
C:\WINDOWS\rrumlnvkj.exe -> Spyware.BetterInternet -> Cleaned without backup
C:\WINDOWS\systb.dll -> Spyware.ImiBar.d -> Cleaned without backup
C:\WINDOWS\systb.dll_tobedeleted -> Spyware.ImiBar.d -> Cleaned without backup
C:\WINDOWS\SYSTEM32\cscrslv.exe -> Trojan.AproposAd -> Cleaned without backup
C:\WINDOWS\SYSTEM32\dun.exe -> Spyware.DealHelper.x -> Cleaned without backup
C:\WINDOWS\SYSTEM32\EDow_AS2.exe -> TrojanDownloader.Wintool.e -> Cleaned without backup
C:\WINDOWS\SYSTEM32\elitekam32.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\SYSTEM32\elitemdk32.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\SYSTEM32\eliteppo32.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\SYSTEM32\elitevnc32.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\SYSTEM32\elitexie32.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\SYSTEM32\elitexmh32.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\SYSTEM32\elitezkr32.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\SYSTEM32\elitezzl32.exe -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\SYSTEM32\HookPopup.dll -> Spyware.DealHelper.ab -> Cleaned without backup
C:\WINDOWS\SYSTEM32\Qshhsg.exe -> Spyware.DealHelper.ac -> Cleaned without backup
C:\WINDOWS\SYSTEM32\temperror32.dat -> Spyware.Hijacker.Generic -> Cleaned without backup
C:\WINDOWS\tdtb.exe -> Trojan.Imiserv.c -> Cleaned without backup
C:\WINDOWS\wupdt.exe -> TrojanDownloader.Intexp.c -> Cleaned without backup
::Report End
*********************************
HijackThis Log
*********************************
Logfile of HijackThis v1.99.1
Scan saved at 7:49:53 AM, on 5/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\system\hpkgrr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Toolbar\TBPSSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.wenxuecity.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ewo7RXi3O] vfpclu.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\RunOnce: [UninstallDellSupport2.x] msiexec /qn /x {43FCA273-9534-40DB-B7C5-D7758875616A}
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Documents and Settings\Yuzhu Zhu\Yuzhu Zhu's Documents\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Documents and Settings\Yuzhu Zhu\Yuzhu Zhu's Documents\jc_link.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\DOCUME~1\YUZHUZ~1\YUZHUZ~1\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\DOCUME~1\YUZHUZ~1\YUZHUZ~1\flashget.exe (file missing)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) -
http://us.dl1.yimg.com/download.yahoo.com/…ropper1_4us.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) -
http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} -
http://www.pacimedia.com/install/pcs_0015.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{9AEDD357-0149-45CC-B748-D516791240D9}: NameServer = 206.141.192.60,206.141.193.55
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7C2E2BD-4F2F-423F-A1F2-5EB2E1DB71C4}: NameServer = 206.141.192.60 206.141.193.55
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
