What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Annoying Pop ups,Bloodhound.32.EP & MediaAccK.exe

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I have been advised in Google 24 hr help desk to recify these lines of HJT log:

(Note: I will paste complete log as a reply to this post, I have removed Nortron AntiVirus after running HJT as this was out of date and advised to be removed in Google thread)

Ref:Google Thread in 24 hr help desk

Daaaaamn! Dump norton and get Avast. www.avast.com
Have Hijackthis fix the following lines


D:\WINDOWS\system32\services.



exe
D:\WINDOWS\system32\exp.exe
D:\WINDOWS\system32\wintask.ex­e
D:\Program Files\Media Access\MediaAccK.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\WINDOWS\system32\nwcmsext.e­xe
D:\WINDOWS\system32\vrnprr.exe
D:\WINDOWS\system32


\winupdt.exe
D:\WINDOWS\seeve.


exe
D:\WINDOWS\system32\j6cb6v3t.e­xe
C:\Program Files\AutoUpdate\AutoUpdate.ex­e
D


:\WINDOWS\system\omgr.exe


C:\Program Files\hotfoon4.exe
D:\Program Files\Cas\Client\casclient.exe
D:\WINDOWS\system32\nmeg6.exe
D:\Program Files\sf\sf.exe
D:\WINDOWS\sfita.exe
D:\DOCUME~1\ADMINI~1\LOCALS~1\­Temp\Adobelm_Cleanup.0001
D:\Program Files


\Common Files\Adobe Systems Shared\Service\Adobelmsvc.



- Hide quoted text -
- Show quoted text -

exe
R1 - HKCU\Software\Microsoft\Intern­et Explorer,SearchURL =
http://searchmiracle.com/sp.ph­p
R1 - HKLM\Software\Microsoft\Intern­et Explorer\Main,Default_Search_U­RL
= http://www.searchforit.com/sea­rchbar
R1 - HKLM\Software\Microsoft\Intern­et Explorer\Main,Search Page =
http://www.searchforit.com/sea­rchbar
R1 - HKCU\Software\Microsoft\Intern­et Explorer\Search,SearchAssistan­t =
http://searchmiracle.com/sp.ph­p
R0 - HKLM\Software\Microsoft\Intern­et Explorer\Search,CustomizeSearc­h =
R0 - HKCU\Software\Microsoft\Intern­et Explorer\Toolbar,LinksFolderNa­me
=
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544­A80E5C4} -
D:\WINDOWS\system32\vbrundll.d­ll
O2 - BHO: Replace Search Ctl - {832BEBED-C3DA-4534-A2C2-B2FFF­220C820} -
D:\WINDOWS\system32\replaceSea­rch.dll
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F6­9777D80} -
D:\WINDOWS\system32\ca.dll


O3 - Toolbar: (no name) - {825CF5BD-8862-4430-B771-0C15C­5CA8DEF} - (no
file)



- Hide quoted text -
- Show quoted text -

O4 - HKLM\..\Run: [PSof1] D:\WINDOWS\system32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] D:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] D:\WINDOWS\system32\wintask.ex­e
O4 - HKLM\..\Run: [regsync] D:\WINDOWS\system32\regsync.ex­e
O4 - HKLM\..\Run: [D:\WINDOWS\VCMnet11.exe] D:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [checkrun] D:\windows\system32\elitemod32­.exe
O4 - HKLM\..\Run: [Media Access] D:\Program Files\Media
Access\MediaAccK.exe
O4 - HKLM\..\Run: [p44f36g] nwcmsext.exe
O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\vrnprr.exe reg_run
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-0000­00004D00}] rundll32.exe
stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0­F7C08EB] rundll32.exe
E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [winupdtl] D:\WINDOWS\system32\winupdt.ex­e
O4 - HKLM\..\Run: [seeve] D:\WINDOWS\seeve.exe
O4 - HKLM\..\Run: [j6cb6v3t] D:\WINDOWS\system32\j6cb6v3t.e­xe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program
Files\AutoUpdate\AutoUpdate.ex­e"
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O4 - HKCU\..\Run: [CAS Client] "D:\Program
Files\Cas\Client\casclient.exe­"
O4 - HKCU\..\Run: [Y3vpRWMmS] nmeg6.exe
O4 - HKCU\..\Run: [sf] D:\Program Files\sf\sf.exe
O4 - HKCU\..\Run: [sfita] D:\WINDOWS\sfita.exe
O8 - Extra context menu item: Convert link target to existing PDF -
res://D:\Program Files\Adobe\Acrobat
7.0\Acrobat\AcroIEFavClient.dl­l/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF -
res://D:\Program Files\Adobe\Acrobat
7.0\Acrobat\AcroIEFavClient.dl­l/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF -
res://D:\Program Files\Adobe\Acrobat
7.0\Acrobat\AcroIEFavClient.dl­l/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF -
res://D:\Program Files\Adobe\Acrobat
7.0\Acrobat\AcroIEFavClient.dl­l/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF -
res://D:\Program Files\Adobe\Acrobat
7.0\Acrobat\AcroIEFavClient.dl­l/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program
Files\Adobe\Acrobat
7.0\Acrobat\AcroIEFavClient.dl­l/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF -
res://D:\Program Files\Adobe\Acrobat
7.0\Acrobat


\AcroIEFavClient.dll/AcroIEApp­end.html


O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: ChatSpace Full Java Client 3.1.0.229


-
http://64.55.105.205/Java/cfs3­1229.cab
O16 - DPF: Jigsaw Detective by pogo -
http://game1.pogo.com/applet-6­.1.3.21/jig…-ob-asset­s.cab
O16 - DPF: Yahoo! Graffiti -
http://download.games.yahoo.co­m/games/clients/y/grt5_x.cab
O16 - DPF: {36A59337-6EEF-40AE-94B1-ED443­A0C4740} -

http://download.abetterinterne­t.com/downl…L59/b­anner.cab
O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51­B2F79DA} -
http://www.alwaysupdatednews.c­om/install/aun_0018.exe
O16 - DPF: {5F3B3060-09E0-44C6-86F7-BC7B0­2B57BEE} -


http://downloads.shopathomesel­ect.com/mam…ma1­004_sp2.cab
O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DD­F75EEE9} (IObjSafety.DemoCtl)
-


http://cabs.media-motor.net/ca­bs/joysaver.cab
O16 - DPF: {972BB342-14A7-4660-83C1-51DDB­EE171DB} -
http://www.pacimedia.com/insta­ll/pcs_0006.exe
O17 -
HKLM\System\CCS\Services\Tcpip­\..\{79C85D60-21FA-4F22-8B2F-1­62EB9CC403A}:
NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.d­ll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program
Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe


When that is done you MUST Download, install, update and run all of the
following. You have way to much carp** on your system.


Ad-Aware
http://www.lavasoftusa.com/sof­tware/adaware/


Spybot search and destroy
http://www.safer-networking.or­g/en/download/


Microsoft Windows AntiSpyware (Beta)
http://www.microsoft.com/athom­e/security/…e/de­fault.mspx


–



The best live web video on the internet http://www.seedsv.com/webdemo.­htm
Sharpvision simply the best http://www.seedsv.com
"Thaqalain" <[removed]> wrote in message
news


:1118712137.399316.315100@z14g­2000cwz.googlegroups.com…
Post #2
Logfile of HijackThis v1.99.1
Scan saved at 9:18:01 PM, on 6/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\wfxsnt40.exe
D:\Program Files\Common Files\AOL\ACS\AOLDial.exe
D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
D:\WINDOWS\system32\exp.exe
D:\WINDOWS\system32\wintask.exe
D:\Program Files\Media Access\MediaAccK.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\Program Files\Norton Internet Security\NISUM.EXE
D:\WINDOWS\system32\nwcmsext.exe
D:\WINDOWS\system32\vrnprr.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\QuickTime\qttask.exe
D:\WINDOWS\system32\winupdt.exe
D:\WINDOWS\seeve.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\j6cb6v3t.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
D:\Program Files\Norton Internet Security\SymProxySvc.exe
D:\WINDOWS\system\omgr.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\hotfoon4.exe
D:\Program Files\Cas\Client\casclient.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\WINDOWS\system32\nmeg6.exe
D:\Program Files\sf\sf.exe
D:\WINDOWS\sfita.exe
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
C:\PROGRA~1\POPUPM~1\POPUPS~1\POP-UP~1\PSFREE.EXE
D:\Program Files\AOL 9.0a\aoltray.exe
D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Adobelm_Cleanup.0001
D:\Program Files\AOL Companion\companion.exe
D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Norton Internet Security\IAMAPP.EXE
D:\Program Files\Norton Internet Security\NISSERV.EXE
D:\Program Files\Norton Antivirus\navapw32.exe
D:\Program Files\Norton Antivirus\navapsvc.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Norton Internet Security\ATRACK.EXE
D:\Program Files\Common Files\Symantec Shared\NMain.exe
D:\Program Files\Norton Antivirus\Navw32.exe
D:\Program Files\Norton Antivirus\Navw32.exe
D:\Program Files\Norton Antivirus\QSERVER.EXE
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\WinRAR\WinRAR.exe
D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX21.188\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://p17.news.re2.yahoo.com/fc/World/Iraq
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchforit.com/searchbar
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchforit.com/searchbar
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - D:\WINDOWS\system32\vbrundll.dll
O2 - BHO: Replace Search Ctl - {832BEBED-C3DA-4534-A2C2-B2FFF220C820} - D:\WINDOWS\system32\replaceSearch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} - D:\WINDOWS\system32\ca.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: (no name) - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [AOLDialer] D:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [msnappau] "D:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] D:\WINDOWS\system32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] D:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] D:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [regsync] D:\WINDOWS\system32\regsync.exe
O4 - HKLM\..\Run: [D:\WINDOWS\VCMnet11.exe] D:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [checkrun] D:\windows\system32\elitemod32.exe
O4 - HKLM\..\Run: [Media Access] D:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [p44f36g] nwcmsext.exe
O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\vrnprr.exe reg_run
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [winupdtl] D:\WINDOWS\system32\winupdt.exe
O4 - HKLM\..\Run: [seeve] D:\WINDOWS\seeve.exe
O4 - HKLM\..\Run: [j6cb6v3t] D:\WINDOWS\system32\j6cb6v3t.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [iamapp] D:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O4 - HKCU\..\Run: [CAS Client] "D:\Program Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [Y3vpRWMmS] nmeg6.exe
O4 - HKCU\..\Run: [sf] D:\Program Files\sf\sf.exe
O4 - HKCU\..\Run: [sfita] D:\WINDOWS\sfita.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\POPUPM~1\POPUPS~1\POP-UP~1\PSFREE.EXE"
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = D:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: AOL Companion.lnk = D:\Program Files\AOL Companion\companion.exe
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://64.55.105.205/Java/cfs31229.cab
O16 - DPF: Jigsaw Detective by pogo - http://game1.pogo.com/applet-6.1.3.21/jigs…w-ob-assets.cab
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt5_x.cab
O16 - DPF: {36A59337-6EEF-40AE-94B1-ED443A0C4740} - http://download.abetterinternet.com/downlo…LL59/banner.cab
O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0018.exe
O16 - DPF: {5F3B3060-09E0-44C6-86F7-BC7B02B57BEE} - http://downloads.shopathomeselect.com/mamm…mma1004_sp2.cab
O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/joysaver.cab
O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia.com/install/pcs_0006.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{79C85D60-21FA-4F22-8B2F-162EB9CC403A}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - D:\WINDOWS\system32\WFXSVC.EXE
Post #3
I run scan with Freedom of Zeroknowlege(Bell sympatico)and discovered 82 files were virus infected, out of which it deleted 78,but these 4 files not yet deleted,please give me technique/alternative solution: C:\Program Files\AutoUpdate\AutoUpdate.ex­e File is infected with "W32/Apropo.C@dl" virus. The file could not be deleted. D:\WINDOWS\system32\exp.exe File is infected with "W32/Small.AF" virus. The file could not be deleted. D:\WINDOWS\system32\wintask.ex­e File is infected with "W32/Small.AF" virus. The file could not be deleted. D:\WINDOWS\system32\winupdt.ex­e File is infected with "W32/Downloader.ASY" virus. The file could not be deleted.
Post #4
Here is scan modified log after running HihghjackThis:
Logfile of HijackThis v1.99.1
Scan saved at 1:56:07 PM, on 6/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\Program Files\Common Files\Command Software\dvpapi.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\wfxsnt40.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Program Files\MSN

Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\QuickTime\qttask.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\vidctrl\vidctrl.exe
D:\WINDOWS\system32\rkmpkk.exe
D:\WINDOWS\System32\igfxtray.exe
D:\WINDOWS\System32\hkcmd.exe
D:\Program Files\Zero Knowledge\Freedom\Freedom.exe
D:\Program Files\Common Files\AOL\ACS\AOLDial.exe
D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
D:\WINDOWS\system\uxikietro.exe
D:\Program Files\Cas\Client\casclient.exe
d:\windows\system32\leclicf.exe
D:\WINDOWS\sfita.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\hotfoon4.exe
D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Adobelm_Cleanup.0001
D:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
D:\Program Files\AOL Companion\companion.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\COMPROB\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://www.searchforit.com/searchbar
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page

= http://www.searchforit.com/searchbar
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://groups-beta.google.com/group/24hoursupport.helpdesk
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://www.searchforit.com/searchbar
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page

= http://www.searchforit.com/searchbar
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,SearchAssistant =

http://www.searchforit.com/searchbar
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet

Explorer\SearchURL,(Default) =

http://www.searchforit.com/searchbar
R0 - HKCU\Software\Microsoft\Internet

Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\Nail.exe
F3 - REG:win.ini: run=D:\disney\saver\disspy.exe
O2 - BHO: CExtension Object -

{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - D:\WINDOWS\cfgmgr52.dll
O2 - BHO: VBRunDLL Class -

{197B8CA4-E215-46DD-8F33-E0544A80E5C4} -

D:\WINDOWS\system32\vbrundll.dll
O2 - BHO: Replace Search Ctl -

{832BEBED-C3DA-4534-A2C2-B2FFF220C820} -

D:\WINDOWS\system32\replaceSearch.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program

files\google\googletoolbar1.dll
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} -

D:\WINDOWS\system32\ca2.dll
O2 - BHO: (no name) - {C370527A-24A7-4583-BE01-72E59000EB17} -

D:\WINDOWS\system32\n.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -

d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program

Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [msnappau] "D:\Program Files\MSN

Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] D:\WINDOWS\system32\PSof1.exe
O4 - HKLM\..\Run: [regsync] D:\WINDOWS\system32\regsync.exe
O4 - HKLM\..\Run: [D:\WINDOWS\VCMnet11.exe]

D:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}]

rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [80000002]

80000002|SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
O4 - HKLM\..\Run: [vidctrl]

D:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE

D:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\rkmpkk.exe

reg_run
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

D:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Freedom] D:\Program Files\Zero

Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [DownloadAccelerator] D:\PROGRA~1\DAP\DAP.EXE

/STARTUP
O4 - HKLM\..\Run: [CallControl 4.5] D:\Program Files\FaxTalk

Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [AOLDialer] D:\Program Files\Common

Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection]

"D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [checkrun] D:\windows\system32\elitemod32.exe
O4 - HKLM\..\Run: [exp.exe] D:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver]

D:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe

D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB]

rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [p44f36g] nwcmsext.exe
O4 - HKLM\..\Run: [wuxqex] d:\windows\system32\leclicf.exe r
O4 - HKCU\..\Run: [CAS Client] "D:\Program

Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [sf] D:\Program Files\sf\sf.exe
O4 - HKCU\..\Run: [sfita] D:\WINDOWS\sfita.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN

Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program

Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Babylon Translator] D:\Program

Files\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Y3vpRWMmS] nmeg6.exe
O4 - HKCU\..\RunOnce: [Deletesearchforit] rundll32.exe

advpack.dll,DelNodeRunDLL32 "D:\WINDOWS\system32\SYSsfitb.dll"
O4 - Global Startup: AOL Companion.lnk = D:\Program Files\AOL

Companion\companion.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = D:\Program

Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Google Search - res://D:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -

res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF -

res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing

PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe

PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing

PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF -

res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF

- res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF -

res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF -

res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://D:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English -

res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program

Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program

Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL

Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL

Toolbar\toolbar.dll
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program

Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program

Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 -

http://64.55.105.205/Java/cfs31229.cab
O16 - DPF: Jigsaw Detective by pogo -

http://game1.pogo.com/applet-6.1.3.21/jigs…aw-ob-assets.ca

b
O16 - DPF: Yahoo! Graffiti -

http://download.games.yahoo.com/games/clients/y/grt5_x.cab
O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} -

http://www.alwaysupdatednews.com/install/aun_0032.exe
O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} -

http://www.pacimedia.com/install/pcs_0006.exe
O20 - Winlogon Notify: igfxcui -

D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program

Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America

Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) -

Unknown owner - D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc.

- D:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation -

D:\WINDOWS\system32\WFXSVC.EXE
Post #5 last edited
pcbutts1 Jun 18, 5:00 pm show options

Newsgroups: 24hoursupport.helpdesk
From: "pcbutts1" <[removed]> - Find messages by this author
Date: Sat, 18 Jun 2005 21:00:23 GMT

Ok, run hijackthis again. place a check mark in the box next each line
below. Once each is checked click on the "Fix Checked" button then reboot
your computer. Say yes to any dialog box.


D:\PROGRA~1\COMMON~1\AOL\ACS\A­OLACSD.EXE
D:\WINDOWS\system32\vidctrl\vi­dctrl.exe
D:\WINDOWS\system32\rkmpkk.


exe
D:\Program Files\Common Files\AOL\ACS\AOLDial.exe
D:\PROGRA~1\COMMON~1\AOL\AOLSP­Y~1\AOLSP Scheduler.exe
D:\WINDOWS\system\uxikietro.ex­e
D:\Program Files\Cas\Client\casclient.exe
d:\windows\system32\leclicf.ex­e
D:\WINDOWS\sfita.exe


C:\Program Files\hotfoon4.


exe
R1 - HKCU\Software\Microsoft\Intern­et Explorer\Main,Search Bar
=http://www.searchforit.com/sea­rchbar
R1 - HKCU\Software\Microsoft\Intern­et Explorer\Main,Search Page=
http://www.searchforit.com/sea­rchbar


R1 - HKLM\Software\Microsoft\Intern­etExplorer\

Main,Default_Search_URL
=http://www.searchforit.com/sea­rchbar
R1 - HKLM\Software\Microsoft\Intern­et Explorer\Main,Search Page=
http://www.searchforit.com/sea­rchbar
R0 - HKLM\Software\Microsoft


\InternetExplorer\Search,Searc­hAssistant
=http://www.searchforit.com/sea­rchbar
R0 - HKLM\Software\Microsoft\Intern­etExplorer\Search,CustomizeSea­rch =
R1 - HKCU\Software\Microsoft\Intern­etExplorer\SearchURL,(Default)
=http://www.searchforit.com/sea­rchbar
R0 - HKCU\Software\Microsoft\Intern­etExplorer\


- Hide quoted text -
- Show quoted text -

Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\Nail.exe
F3 - REG:win.ini: run=D:\disney\saver\disspy.exe
O2 - BHO: CExtension Object -{0019C3E2-DD48-4A6D-ABCD-8D32­436323D9} -
D:\WINDOWS\cfgmgr52.dll
O2 - BHO: VBRunDLL
Class -{197B8CA4-E215-46DD-8F33-E054­4A80E5C4} -D:\WINDOWS\system32\vbrundll.­dll
O2 - BHO: Replace Search
Ctl -{832BEBED-C3DA-4534-A2C2-B2FF­F220C820} -D:\WINDOWS\system32\replaceSe­arch.dll
O2 - BHO: Cas -
{B5F3970B-745E-46AC-B890-E08F6­9777D80} -D:\WINDOWS\system32\ca2.dll
O2 - BHO: (no name) -
{C370527A-24A7-4583-BE01-72E59­000EB17} -D:\WINDOWS\system32\n.dll
O4 - HKLM\..\Run: [PSof1] D:\WINDOWS\system32\PSof1.exe
O4 - HKLM\..\Run: [regsync] D:\WINDOWS\system32\regsync.ex­e
O4 - HKLM\..\Run: [D:\WINDOWS\VCMnet11.exe]D:\WI­NDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-0000­00004D00}]rundll32.exe
stlb2.dll,DllRunMain
O4 - HKLM\..\Run:
[80000002]80000002|SOFTWARE\Mi­crosoft\Windows\CurrentVersion­\Run\
O4 - HKLM\..\Run: [vidctrl]D:\WINDOWS\system32\v­idctrl\vidctrl.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32


.EXED:\

WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\rkmpkk.exe reg_run
O4 - HKLM\..\Run: [AOLDialer] D:\Program Files\Common
Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [checkrun] D:\windows\system32\elitemod32­.exe
O4 - HKLM\..\Run: [exp.exe] D:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver]D:\WINDOWS\system32\win­task.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32


.exeD0CE0C16B1,

D0CE0C16B1
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0­F7C08EB]rundll32.exe
E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [p44f36g] nwcmsext.exe
O4 - HKLM\..\Run: [wuxqex] d:\windows\system32\leclicf.ex­e r
O4 - HKCU\..\Run: [CAS Client] "D


:\ProgramFiles\

Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [sf] D:\Program Files\sf\sf.exe
O4 - HKCU\..\Run: [sfita] D:\WINDOWS\sfita.exe
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O4 - HKCU\..\Run


: [Y3vpRWMmS] nmeg6.exe
O4 - HKCU\..\RunOnce: [Deletesearchforit]
rundll32.exeadvpack.dll,DelNod­eRunDLL32 "D:\WINDOWS\system32\SYSsfitb.­dll"

O16 - DPF: ChatSpace Full Java Client
3.1.0.229 -http://64.55.105.205/Java/cfs3­1229.cab
O16 - DPF: Jigsaw Detective by
pogo -http://game1.pogo.com/applet-6­.1.3.21/jigsaw/jigsaw-ob-asset­s.cab
O16 - DPF: Yahoo!
Graffiti -http://download.games.yahoo.co­m/games/clients/y/grt5_x.cab
O16 - DPF:
{47CD99DF-8BCF-4B9B-94EF-02E51­B2F79DA} -ttp://www.alwaysupdatednews.com/inst­all/aun_0032.exe
O16 - DPF:
{972BB342-14A7-4660-83C1-51DDB­EE171DB} -http://www.pacimedia.com/insta­ll/pcs_0006.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc.- D:\Program
Files\Common Files\Command Software\dvpapi.exe

Pcbutts:
Breaking news:
I run HIghjacThis to rectify specified lines,Computer working very
well.Many thanks to u and others who have given their dedicated
techniques for troubleshooting my computer.
My Hotfoon is neither signing nor made contact.
Do u think,I have to scan with HighjackThis to make sure system's
performance as a preventive measure?
Once again Thanks.
Post #6
Hello Thaqalain and welcome to TomCoyote. :wavey:
I see that you were receiving help at Google but they are not attacking the fixes correctly. If you want help from TC than please do not post for help at any other forum. This is a waste of the helpers time.
  • Download this tool : LQfix.zip
    • Unzip it to your Desktop.
    • Don't use it yet!
  • Download and install Ewido security suite.
    • Launch Ewido, there should be an icon on your desktop for it to double-click.
      • The program will prompt you to update, click the OK button.
      • The program will now go to the main screen.
    • You will need to update ewido to the latest definition files.
      • On the left hand side of the main screen click update.
      • Click on Start.
      • The update will start and a progress bar will show the updates being installed.
    • Once the updates are installed, close the program.
  • Please download Nailfix.
    • Unzip it to the desktop but please do NOT run it yet.

Reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml
  • Doubleclick LQfix.bat that you saved on your desktop before.
    • A dos window will open and close again, that is normal.
  • Run Nailfix
    • Once in Safe Mode, please double-click on Nailfix.cmd.
      Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.
  • Scan with Ewido
    • Launch Ewido again.
      • Click on scanner.
      • Make sure the following boxes are checked before scanning:
        • Binder
        • Crypter
        • Archives
    • Click on Start Scan.
      • Let the program scan the machine.
      • While the scan is in progress you will be prompted to clean files, click OK.
    • Once the scan has completed, there will be a button located on the bottom of the screen named Save report.
      • Click Save report.
      • Save the report to your desktop.
  • Fix with HijackThis
    • Next please run HijackThis, click Scan, and check the following (if still present):

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchforit.com/searchbar
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchforit.com/searchbar
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchforit.com/searchbar
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchforit.com/searchbar
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchforit.com/searchbar
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchforit.com/searchbar
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

      F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\Nail.exe

      O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - D:\WINDOWS\cfgmgr52.dll
      O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - D:\WINDOWS\system32\vbrundll.dll
      O2 - BHO: Replace Search Ctl - {832BEBED-C3DA-4534-A2C2-B2FFF220C820} - D:\WINDOWS\system32\replaceSearch.dll
      O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} - D:\WINDOWS\system32\ca2.dll
      O2 - BHO: (no name) - {C370527A-24A7-4583-BE01-72E59000EB17} - D:\WINDOWS\system32\n.dll

      O4 - HKLM\..\Run: [PSof1] D:\WINDOWS\system32\PSof1.exe
      O4 - HKLM\..\Run: [D:\WINDOWS\VCMnet11.exe] D:\WINDOWS\VCMnet11.exe
      O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
      O4 - HKLM\..\Run: [80000002] 80000002|SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
      O4 - HKLM\..\Run: [vidctrl] D:\WINDOWS\system32\vidctrl\vidctrl.exe
      O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE D:\WINDOWS\cfgmgr52.dll,DllRun
      O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\rkmpkk.exe reg_run
      O4 - HKLM\..\Run: [exp.exe] D:\WINDOWS\system32\exp.exe
      O4 - HKLM\..\Run: [WinTask driver] D:\WINDOWS\system32\wintask.exe
      O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
      O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
      O4 - HKLM\..\Run: [p44f36g] nwcmsext.exe
      O4 - HKLM\..\Run: [wuxqex] d:\windows\system32\leclicf.exe r
      O4 - HKCU\..\Run: [sf] D:\Program Files\sf\sf.exe
      O4 - HKCU\..\Run: [sfita] D:\WINDOWS\sfita.exe
      O4 - HKCU\..\Run: [Y3vpRWMmS] nmeg6.exe
      O4 - HKCU\..\RunOnce: [Deletesearchforit] rundll32.exe advpack.dll,DelNodeRunDLL32 "D:\WINDOWS\system32\SYSsfitb.dll"

      O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0032.exe
      O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia.com/install/pcs_0006.exe
    • Close all other programs and browsers and click Fix Checked.
  • Delete files/Folders
    • While still in Safe mode, delete the following files/folders:

      These Files
      D:\WINDOWS\VCMnet11.exe
      D:\WINDOWS\cfgmgr52.dll
      D:\WINDOWS\sfita.exe
      D:\WINDOWS\system32\PSof1.exe
      D:\WINDOWS\system32\rkmpkk.exe
      D:\WINDOWS\system32\exp.exe
      D:\WINDOWS\system32\wintask.exe
      d:\windows\system32\leclicf.exe

      You'll need to search for these files with Explorer to delete. They may be in C:\WINDOWS\system32\ or C:\WINDOWS\
      (Start > Search > All files and folders > More advanced options place a check in the first three boxes)
      stlb2.dll
      D0CE0C16B1.dll
      E6F1873B.DLL
      D9EBC318C.dll
      nwcmsext.exe
      nmeg6.exe

      These Folders
      D:\WINDOWS\system32\vidctrl
      D:\Program Files\sf
  • Restart your computer in normal mode and post a new HijackThis log, as well as the log from the Ewido scan. Be sure to turn off Word Wrap in notepad before replying to the thread. In Notepad, click Format and uncheck Word Wrap.
Post #7
———————————————————
ewido security suite - Startup report———————————————————

+ Created on: 10:06:04 PM, 6/20/2005
+ Report-Checksum: 6C3B8D21

Reg\HKLM\Run Symantec NetDriver Monitor D:\PROGRA~1\SYMNET~1\SNDMon.exe
Reg\HKLM\Run TkBellExe "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Reg\HKLM\Run WinFaxAppPortStarter wfxsnt40.exe
Reg\HKLM\Run Acrobat Assistant 7.0 "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
Reg\HKLM\Run
Reg\HKLM\Run msnappau "D:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
Reg\HKLM\Run QuickTime Task "D:\Program Files\QuickTime\qttask.exe" -atboottime
Reg\HKLM\Run HotKeysCmds D:\WINDOWS\System32\hkcmd.exe
Reg\HKLM\Run IgfxTray D:\WINDOWS\System32\igfxtray.exe
Reg\HKLM\Run Freedom D:\Program Files\Zero Knowledge\Freedom\Freedom.exe
Reg\HKLM\Run CallControl 4.5 D:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
Reg\HKLM\Run DownloadAccelerator D:\PROGRA~1\DAP\DAP.EXE /STARTUP
Reg\HKLM\Run AOL Spyware Protection "D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
Reg\HKCU\Run msnmsgr "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
Reg\HKCU\Run Yahoo! Pager D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
Reg\HKCU\Run Babylon Translator D:\Program Files\Babylon\Babylon.exe
Reg\HKCU\Run HOTFOON2 C:\Program Files\hotfoon4.exe /h
Shell\CommonStartup ndti.exe D:\Documents and Settings\All Users\Start Menu\Programs\Startup\ndti.exe
Shell\CommonStartup AOL Companion.lnk D:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
Shell\CommonStartup AOL 9.0 Tray Icon.lnk D:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk
Shell\CommonStartup Adobe Acrobat Speed Launcher.lnk D:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
Shell\CommonStartup WinZip Quick Pick.lnk D:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

Logfile of HijackThis v1.99.1Scan saved at 10:02:49 PM, on 6/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\COMPROB\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://groups-beta.google.com/group/24hoursupport.helpdesk
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [msnappau] "D:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Freedom] D:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [DownloadAccelerator] D:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [CallControl 4.5] D:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [AOL Spyware Protection] "D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Babylon Translator] D:\Program Files\Babylon\Babylon.exe
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O4 - Global Startup: ndti.exe
O4 - Global Startup: AOL Companion.lnk = D:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = D:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - D:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - D:\WINDOWS\system32\WFXSVC.EXE
Post #8
Download CCleaner from here to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
  • Click Run Cleaner to run the program.
  • After it has completed it's process, click Exit.
Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.

Click here to download mwavscan.
  • Double-click it to run it.
  • Read then accept the agreement.
  • Check Drive, and select all local drives, scan all files, then press 'scan'. (This may take a while and will not fix anything)
  • Once it finds something, it will prompt you so click OK.
  • When it is completed, anything found will be displayed in the lower pane.
  • Highlight it, copy it (CTRL+C), and paste (CTRL+V) it in your next reply.
Note : It will find many orphaned registry entries so please do not be alarmed by the amount of items that show.

Post a fresh HijackThis log and the log from mwavscan as a reply to this thread. Be sure the log from Hijackthis is run in normal mode.
Post #9 last edited
I forget to mention the status of Delete files,u asked me to do, I think I should wait to for your reply before running CC Cleaner,mwavscan and posting fresh HJT log:
Delete files/Folders
While still in Safe mode, delete the following files/folders:

These Files
D:\WINDOWS\VCMnet11.exe
D:\WINDOWS\cfgmgr52.dll
D:\WINDOWS\sfita.exe (Not there)
D:\WINDOWS\system32\PSof1.exe
D:\WINDOWS\system32\rkmpkk.exe(Can't delete)
D:\WINDOWS\system32\exp.exe (Not there)
D:\WINDOWS\system32\wintask.exe (Not there)
d:\windows\system32\leclicf.exe (Not there)

You'll need to search for these files with Explorer to delete. They may be in C:\WINDOWS\system32\ or C:\WINDOWS\
(Start > Search > All files and folders > More advanced options place a check in the first three boxes)
stlb2.dll (is not dll,instead it is XML)
D0CE0C16B1.dll (not there)
E6F1873B.DLL (not there)
D9EBC318C.dll (not there)
nwcmsext.exe (Not there)
nmeg6.exe (Not there)

These Folders
D:\WINDOWS\system32\vidctrl
D:\Program Files\sf
Post #10
Go ahead with the last set of instructions and I'll include those files in the next fix. I'm off to be now as it is 5:30 a.m. here, will reply when I wake up.
Post #11
CLEANING COMPLETE - (361.194 secs)——————————————————————————————
482.3MB removed.


Details of files deleted
——————————————————————————————
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://jobs.workopolis.com/jobshome/db/wor…=Adlet_EN(&H41;) 26 bytes
http://gfx1.hotmail.com/i.p.im_on.gif(&H41;) 263 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://ad.ca.doubleclick.net/adj/www.worko…654902397?(&H1;) 299 bytes
http://www.spywareinfo.com/favicon.ico(&H45;) 2.19KB
http://ad.ca.doubleclick.net/adi/www.worko…437531?(&H8001;) 356 bytes
http://forums.tomcoyote.org/style_images/i…p_box.gif(&H41;) 44 bytes
http://m.2mdn.net/viewad/1000568/pivotal_banner.gif(&H41;) 10.31KB
http://us.news3.yimg.com/us.i2.yimg.com/p/…Bivwj8vQ–(&H5;) 22.52KB
http://ads.workopolis.com/company_logos/34…40603.gif(&H41;) 1.71KB
http://gfx1.hotmail.com/i.p.trash.gif(&H41;) 549 bytes
http://www.bleepingcomputer.com/favicon.ico(&H45;) 1.37KB
http://gfx1.hotmail.com/i.p.cal.meet.req.gif(&H41;) 248 bytes
http://www.workopolis.com/ora/career_image…alert.gif(&H41;) 90 bytes
http://us.a1.yimg.com/us.yimg.com/lib/hdr/ygma5.css(&H5;) 1.38KB
http://pagead2.googlesyndication.com/pagea…_java=true(&H1;) 4.32KB
http://gfx1.hotmail.com/i.p.folder.drafts.gif(&H41;) 240 bytes
http://www.workopolis.com/includes/global/…wn_box.js(&H41;) 3.44KB
http://ad.ca.doubleclick.net/adj/www.worko…003268914?(&H1;) 11 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://gfx1.hotmail.com/i.p.folder.gif(&H41;) 163 bytes
http://service1.symantec.com/favicon.ico(&H45;) 1.37KB
http://gfx1.hotmail.com/i.p.folder.sent.gif(&H41;) 162 bytes
http://jobs.workopolis.com/jobshome/db/wor…=Adlet_EN(&H41;) 26 bytes
http://img-cdn.mediaplex.com/ads/4704/2388…er_2L.gif(&H41;) 7.04KB
http://m.2mdn.net/viewad/376422/1-728x90_blank.gif(&H41;) 392 bytes
http://gfx1.hotmail.com/i.F42B5.gif(&H41;) 172 bytes
http://gfx1.hotmail.com/i.p.cal.task.gif(&H41;) 249 bytes
KlEB4r+++HBP9BMttv/1E9Lwd54=(&H5) 16.59KB
http://ad.ca.doubleclick.net/adi/www.worko…635744986?(&H1;) 426 bytes
http://ad.ca.doubleclick.net/adj/www.worko…902397?(&H8001;) 8.41KB
http://p9.news.re2.yahoo.com/v10/us/news/css/ynews.css(&H45;) 55.24KB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://m.2mdn.net/1024542/banner_468.swf?c…%3D126901(&H41;) 9.64KB
http://forums.tomcoyote.org/style_images/i…_logo.gif(&H41;) 3.85KB
http://www.workopolis.com/includes/global/…yright.js(&H41;) 4.19KB
http://us.i1.yimg.com/us.yimg.com/lib/comm…040826.css(&H5;) 739 bytes
http://gfx1.hotmail.com/i.p.greetcard.gif(&H41;) 232 bytes
http://gfx1.hotmail.com/i.p.lastpg.gif(&H41;) 148 bytes
huBmXqblCwe17lDOtrUBu/C+kpY=(&H5) 20.72KB
http://gfx1.hotmail.com/i.p.cont.individual.gif(&H41;) 246 bytes
http://global.msads.net/ads/363/0000000363…89644.gif(&H41;) 1.18KB
http://m.2mdn.net/viewad/991011/Anthem-R_4…_24kb.gif(&H41;) 20.27KB
9B4e/RmT/8sQtGAyCFmTnqlfWhI=(&H5) 15.50KB
http://gfx1.hotmail.com/i.F4A7B.gif(&H41;) 174 bytes
CvuEm8CpXHiNcs6mppRHbUzGDDg=(&H5) 17.55KB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://jobs.workopolis.com/jobshome/db/wor…irm_edit=(&H41;) 65.19KB
http://ad.ca.doubleclick.net/adj/www.worko…963021085?(&H1;) 8.41KB
(&H5) 272 bytes
http://news.yahoo.com/favicon.ico(&H8045;) 318 bytes
http://ad.ca.doubleclick.net/adi/www.worko…128988?(&H8001;) 414 bytes
http://www.lookup.ws/favicon.ico(&H45;) 1.37KB
http://ad.ca.doubleclick.net/adi/www.worko…968370698?(&H1;) 346 bytes
http://jobs.workopolis.com/jobshome/db/wor…&iaction;=(&H41;) 14.33KB
http://iraqtunnel.com/php/style_images/1/p_pm.gif(&H41;) 1.64KB
http://gfx1.hotmail.com/i.F42AB.gif(&H41;) 166 bytes
http://us.i1.yimg.com/us.yimg.com/i/nt/ic/…in12_1.gif(&H5;) 99 bytes
http://img.photobucket.com/albums/v280/Tha…owimg.jpg(&H41;) 55.51KB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://www.workopolis.com/ora/career_image…_info.gif(&H41;) 555 bytes
http://jobs.workopolis.com/jobshome/db/wor…d=7567854(&H41;) 22.50KB
http://ad.ca.doubleclick.net/adj/www.worko…991665988?(&H1;) 299 bytes
http://www.workopolis.com/ora/career_images/see.gif(&H41;) 516 bytes
http://jobs.workopolis.com/jobshome/db/wor…irm_edit=(&H41;) 65.06KB
http://jobs.workopolis.com/jobshome/db/wor…=Adlet_EN(&H41;) 26 bytes
http://gfx1.hotmail.com/i.p.sort.desc.gif(&H41;) 53 bytes
http://gfx1.hotmail.com/i.p.attach.gif(&H41;) 68 bytes
http://ad.ca.doubleclick.net/adj/www.worko…554539364?(&H1;) 8.41KB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
hW9aXi630MiPQKya6Ko0gP6lL0g=(&H5) 15.96KB
http://gfx1.hotmail.com/i.p.cont.group.gif(&H41;) 256 bytes
http://gfx1.hotmail.com/i.F424A.gif(&H41;) 175 bytes
http://forums.tomcoyote.org/style_images/i…yahoo.gif(&H41;) 153 bytes
http://forums.tomcoyote.org/style_emoticon…bdown.gif(&H41;) 960 bytes
http://pagead2.googlesyndication.com/pagea…_java=true(&H1;) 4.13KB
http://ads.workopolis.com/company_logos/31…106_A.gif(&H41;) 1.04KB
http://jobs.workopolis.com/jobshome/db/wor…irm_edit=(&H41;) 63.06KB
m8wcNEFzv+WFCplgIBMMZj/0qOo=(&H5) 13.29KB
http://forums.tomcoyote.org/style_images/i…utton.gif(&H41;) 1.12KB
http://www.shiachat.com/forum/style_images…dpoll.gif(&H41;) 1.87KB
http://ad.ca.doubleclick.net/adi/www.worko…623946?(&H8001;) 408 bytes
http://forums.tomcoyote.org/style_images/i…minus.gif(&H41;) 377 bytes
http://www.iraqtunnel.com/php/style_images…earch.gif(&H41;) 576 bytes
http://forums.tomcoyote.org/style_images/i…icon7.gif(&H41;) 372 bytes
http://www.shiachat.com/forum/uploads/av-18492.jpg(&H41;) 1.52KB
http://jobs.workopolis.com/jobshome/db/wor…&iaction;=(&H41;) 14.32KB
http://ad.ca.doubleclick.net/adi/www.worko…003268914?(&H1;) 356 bytes
http://jobs.workopolis.com/jobshome/db/wor…=Adlet_EN(&H41;) 26 bytes
http://ad.ca.doubleclick.net/adj/www.worko…362429972?(&H1;) 299 bytes
http://ads.workopolis.com/company_logos/17…424_A.gif(&H41;) 793 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://ad.ca.doubleclick.net/adi/www.worko…061136176?(&H1;) 340 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://forums.tomcoyote.org/style_images/i…nonew.gif(&H41;) 581 bytes
http://forums.tomcoyote.org/style_images/i…fline.gif(&H41;) 1.29KB
http://forums.tomcoyote.org/style_images/i…con14.gif(&H41;) 363 bytes
cU08SOANXcAgQxTGKQGU5rGg/u8=(&H5) 8.78KB
http://us.news3.yimg.com/us.i2.yimg.com/p/…je.2_Dtw–(&H5;) 18.14KB
http://us.i1.yimg.com/us.yimg.com/i/us/my/…yahoo3.gif(&H5;) 568 bytes
http://jobs.workopolis.com/images/spacer.gif(&H41;) 61 bytes
http://ad.ca.doubleclick.net/adj/www.worko…554539364?(&H1;) 299 bytes
http://www.workopolis.com/ora/images//tbr.gif(&H41;) 817 bytes
http://m.2mdn.net/viewad/991419/pinpoint.gif(&H41;) 8.35KB
http://ads.workopolis.com/company_logos/73…526_A.gif(&H41;) 1.80KB
http://www.workopolis.com/images/fadeleft.gif(&H41;) 122 bytes
http://pagead2.googlesyndication.com/pagea…_java=true(&H1;) 7.32KB
Z5T3itohi74qR/xsfQGWafhGXDY=(&H5) 22.49KB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://www.shiachat.com/forum/style_images…t_sql.gif(&H41;) 633 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://gfx1.hotmail.com/i.p.prevpg.d.gif(&H41;) 124 bytes
http://ads.workopolis.com/company_logos/rim.gif(&H41;) 793 bytes
http://forums.tomcoyote.org/jscripts/ipb_forum.js(&H41;) 2.05KB
http://z1.extreme-dm.com/z/?tag=shiachat&j;…srb=32&l;=(&H41;) 43 bytes
http://p9.news.re2.yahoo.com/v10/us/news/i…common.js(&H45;) 1.88KB
http://p9.news.re2.yahoo.com/fc/World/Iraq(&H45;) 6.95KB
http://gfx1.hotmail.com/i.p.firstpg.d.gif(&H41;) 145 bytes
http://gfx1.hotmail.com/i.p.im_off.gif(&H41;) 267 bytes
http://www.workopolis.com/includes/global/…/aHdr4.js(&H41;) 4.30KB
http://iraqtunnel.com/php/style_images/1/t_new.gif(&H41;) 2.57KB
http://z1.extreme-dm.com/i/(&H41;) 1004 bytes
http://ad.ca.doubleclick.net/adi/www.worko…133088145?(&H1;) 409 bytes
http://www.workopolis.com/includes/global/…aXptn4.js(&H41;) 1.83KB
http://global.msads.net/ads/55716/00000557…46006.gif(&H41;) 1.12KB
http://visitors.workopolis.com/visitor.gif…on%3Aabe2(&H41;) 43 bytes
http://www.workopolis.com/ora/images//tbl.gif(&H41;) 817 bytes
http://www.shiachat.com/forum/style_images…elete.gif(&H41;) 1.55KB
http://www.workopolis.com/images/spacer.gif(&H41;) 61 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://ad.ca.doubleclick.net/adi/www.worko…185871245?(&H1;) 349 bytes
http://jobs.workopolis.com/jobshome/db/wor…irm_edit=(&H41;) 65.04KB
http://ad.ca.doubleclick.net/adj/www.worko…636606652?(&H1;) 11 bytes
http://forums.tomcoyote.org/style_images/i…orner.gif(&H41;) 67 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://ad.ca.doubleclick.net/adi/www.worko…521241?(&H8001;) 365 bytes
http://forums.tomcoyote.org/jscripts/ipb_board.js(&H41;) 242 bytes
http://www.shiachat.com/forum/style_images…nonew.gif(&H41;) 256 bytes
http://www.workopolis.com/images/tbl.gif(&H41;) 47 bytes
http://m.2mdn.net/viewad/994731/20030929.gif(&H41;) 32.00KB
http://jobs.workopolis.com/jobshome/db/wor…=Adlet_EN(&H41;) 26 bytes
http://jobs.workopolis.com/jobshome/db/wor…d=7568008(&H41;) 20.76KB
http://smileys.smileycentral.com/cat/28/28_1_14.gif(&H41;) 30.94KB
http://forums.tomcoyote.org/style_emoticon…nting.gif(&H41;) 17.94KB
http://www.iraqtunnel.com/php/style_images…mbers.gif(&H41;) 685 bytes
http://us.i1.yimg.com/us.yimg.com/i/us/ext/xml.gif(&H5;) 452 bytes
http://ad.ca.doubleclick.net/adj/www.worko…446128988?(&H1;) 11 bytes
hoGXH2X+/QscRIf/70FWwpYLaBA=(&H5) 22.53KB
http://ad.ca.doubleclick.net/adj/www.worko…429972?(&H8001;) 8.41KB
http://forums.tomcoyote.org/style_images/i…icon2.gif(&H41;) 312 bytes
http://global.msads.net/ads/8013/000000801…07267.gif(&H41;) 1.09KB
http://pagead2.googlesyndication.com/pagea…_java=true(&H1;) 4.18KB
http://www.shiachat.com/forum/style_images/1/stats.gif(&H41;) 478 bytes
http://z1.extreme-dm.com/z/?tag=shiachat&j;…om/forum/(&H41;) 43 bytes
http://www.workopolis.com/includes/local/g…style.css(&H41;) 4.73KB
http://ad.ca.doubleclick.net/adi/www.worko…570006301?(&H1;) 369 bytes
KuDw7k0G2zN22Sx39htkmlbuzpo=(&H5) 23.59KB
http://www.workopolis.com/ora/career_image…y_res.gif(&H41;) 256 bytes
http://gfx1.hotmail.com/i.p.arr.left.gif(&H41;) 56 bytes
http://gfx1.hotmail.com/i.p.importance.h.gif(&H41;) 160 bytes
http://www.workopolis.com/includes/global/…unt_en.js(&H41;) 561 bytes
http://pagead2.googlesyndication.com/pagea…_java=true(&H1;) 4.27KB
http://jobs.workopolis.com/jobshome/db/wor…=Adlet_EN(&H41;) 26 bytes
http://forums.tomcoyote.org/html/emoticons/thumbup.gif(&H41;) 958 bytes
http://forums.tomcoyote.org/style_images/i…tpost.gif(&H41;) 376 bytes
http://www.workopolis.com/includes/global/…/aFmt4.js(&H41;) 1.17KB
http://cb.ce.com/images/icons/canada_jtm.gif(&H1;) 2.73KB
http://www.workopolis.com/ora/career_image…small.gif(&H41;) 568 bytes
http://www.workopolis.com/images/go.gif(&H41;) 139 bytes
http://toolbarqueries.google.com/search?cl…346495939(&H41;) 14 bytes
http://www.shiachat.com/forum/style_images…minus.gif(&H41;) 59 bytes
http://forums.tomcoyote.org/style_images/i…orner.gif(&H41;) 68 bytes
http://forums.tomcoyote.org/style_images/i…moved.gif(&H41;) 904 bytes
http://forums.tomcoyote.org/style_emoticon…/wink.gif(&H41;) 698 bytes
http://www.shiachat.com/forum/style_emotic…/pbuh.gif(&H41;) 1.74KB
http://z1.extreme-dm.com/z/?tag=shiachat&j;…%26f%3D45(&H41;) 43 bytes
http://news.google.com/news?imgefp=GSxKyUx…a40b2.jpg(&H41;) 1.18KB
http://www.shiachat.com/forum/style_images…moved.gif(&H41;) 85 bytes
http://www.shiachat.com/forum/style_emotic…t/mad.gif(&H41;) 699 bytes
http://www.abc.net.au/reslib/200312/r13400_32327.jpg(&H8041;) 17.67KB
http://3.adbrite.com/mb/text_group2.php?si…aper&br;=1(&H41;) 6.79KB
http://www.iraqpatrol.com/kurdi.jpg(&H41;) 13.36KB
http://www.shiachat.com/forum/style_images…icon2.gif(&H41;) 676 bytes
http://www.netnation.ca/promo/domainname/(&H8041;) 9.28KB
http://www.netnation.ca/promo/js/ms_shared…urator.js(&H41;) 4.57KB
http://pagead2.googlesyndication.com/pagea…_java=true(&H1;) 4.20KB
http://forums.tomcoyote.org/style_images/i…pacer.gif(&H41;) 43 bytes
http://forums.tomcoyote.org/style_emoticon…nsure.gif(&H41;) 897 bytes
http://forums.tomcoyote.org/index.php?show…&p;=178203&(&H1;) 0.14MB
http://iraqtunnel.com/php/style_images/1/nav_m.gif(&H41;) 53 bytes
http://forums.tomcoyote.org/style_images/i…tions.gif(&H41;) 2.00KB
http://iraqtunnel.com/php/style_images/1/nav.gif(&H41;) 1.05KB
http://www.shiachat.com/forum/(&H1;) 92.32KB
http://forums.tomcoyote.org/style_images/i…f_new.gif(&H41;) 375 bytes
http://news.bbc.co.uk/media/images/4108400…2_300.jpg(&H41;) 14.36KB
http://i.cnn.net/cnn/.element/img/1.1/misc…ptions.gif(&H1;) 795 bytes
http://forums.tomcoyote.org/style_images/i…t_off.gif(&H41;) 64 bytes
http://photos14.flickr.com/19974973_f33ff45c1e.jpg(&H41;) 9.39KB
gl1V8DXVe3tfFK8U8+X1WrOqLfo=(&H5) 17.75KB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://www.shiachat.com/forum/style_emotic…lt/as.gif(&H41;) 1.53KB
http://www.shiachat.com/forum/style_emotic…t/qas.gif(&H41;) 1.39KB
http://www.workopolis.com/images/faderight.gif(&H41;) 124 bytes
http://www.workopolis.com/images/tbr.gif(&H41;) 47 bytes
4HD2Ez1Bofij5KplvDUxyuxG05s=(&H5) 11.83KB
http://jobs.workopolis.com/jobshome/db/wor…irm_edit=(&H41;) 65.07KB
http://jobs.workopolis.com/jobshome/db/wor…=Adlet_EN(&H41;) 26 bytes
http://m.2mdn.net/viewad/1046230/banner.gif(&H41;) 8.01KB
http://jobs.workopolis.com/jobshome/db/wor…&iaction;=(&H41;) 14.33KB
http://jobs.workopolis.com/jobshome/db/wor…irm_edit=(&H41;) 16.57KB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://forums.tomcoyote.org/style_images/i…orner.gif(&H41;) 68 bytes
http://jobs.workopolis.com/jobshome/db/wor…irm_edit=(&H41;) 18.35KB
http://ad.ca.doubleclick.net/adi/www.worko…606652?(&H8001;) 353 bytes
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://forums.tomcoyote.org/style_images/i…wpost.gif(&H41;) 82 bytes
http://forums.tomcoyote.org/style_images/i…_edit.gif(&H41;) 1.38KB
http://www.shiachat.com/forum/style_images…e_aim.gif(&H41;) 163 bytes
http://pagead2.googlesyndication.com/pagea…_java=true(&H1;) 4.22KB
http://ad.ca.doubleclick.net/adj/www.worko…963021085?(&H1;) 299 bytes
http://ads.workopolis.com/company_logos/42…50427.gif(&H41;) 2.80KB
http://m.2mdn.net/viewad/1046224/TNT_Banner1.gif(&H41;) 11.02KB
http://forums.tomcoyote.org/style_images/i…ottom.gif(&H41;) 45 bytes
http://forums.tomcoyote.org/index.php?act=…ype=topics(&H1;) 38.03KB
http://forums.tomcoyote.org/style_images/i…losed.gif(&H41;) 371 bytes
http://forums.tomcoyote.org/index.php?show…=39939&hl;=(&H1;) 0.15MB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://gfx1.hotmail.com/i.F4A85.gif(&H41;) 174 bytes
http://jobs.workopolis.com/jobshome/db/wor…d=7567934(&H41;) 26.66KB
http://forums.tomcoyote.org/style_images/i…c_new.gif(&H41;) 375 bytes
http://forums.tomcoyote.org/style_images/i…rm_no.gif(&H41;) 338 bytes
http://forums.tomcoyote.org/style_images/i…f_hot.gif(&H41;) 378 bytes
2ISrI26APyMzAnq0gJtr/9YqiwY=(&H5) 20.69KB
http://jobs.workopolis.com/jobshome/db/wor…=Adlet_EN(&H41;) 26 bytes
http://ad.ca.doubleclick.net/adj/www.worko…669812?(&H8001;) 8.41KB
http://www.shiachat.com/forum/style_images…nline.gif(&H41;) 1.20KB
http://www.inminds.co.uk/boycott-israel-bullet.gif(&H41;) 1.27KB
http://pagead2.googlesyndication.com/pagea…_java=true(&H1;) 4.17KB
http://forums.tomcoyote.org/uploads/av-10370.jpg(&H41;) 9.51KB
http://forums.tomcoyote.org/style_images/i…icon4.gif(&H41;) 345 bytes
http://www.shiachat.com/forum/uploads/av-19332.jpg(&H41;) 2.50KB
http://www.shiachat.com/forum/style_images/1/p_pm.gif(&H41;) 1.19KB
http://www.lookup.ws/closed.gif(&H41;) 189 bytes
http://jobs.workopolis.com/jobshome/db/wor…7567802(&H1041;) 22.57KB
http://ads.workopolis.com/company_logos/89…50527.gif(&H41;) 2.27KB
http://gfx1.hotmail.com/i.p.nextpg.gif(&H41;) 124 bytes
http://forums.tomcoyote.org/style_images/i…e_icq.gif(&H41;) 163 bytes
CWKlKODMVbRMwdc1yYpgQN4+sAA=(&H5) 15.93KB
http://forums.tomcoyote.org/style_emoticon…ongue.gif(&H41;) 698 bytes
http://www.workopolis.com/ora/career_image…_res2.gif(&H41;) 604 bytes
http://ads.workopolis.com/company_logos/bell.gif(&H41;) 824 bytes
http://images.pcworld.com/shared/graphics/favicon.ico(&H45;) 3.55KB
http://www.shiachat.com/forum/style_images/1/calen.gif(&H41;) 369 bytes
http://www.shiachat.com/forum/style_images…q_add.gif(&H41;) 1.59KB
http://www.interventionmag.com/cms/img/ira…tnam4.jpg(&H41;) 21.66KB
http://www.iraqpatrol.com/php/style_images/1/top.jpg(&H41;) 68.49KB
http://ads.workopolis.com/company_logos/ats-rel.gif(&H41;) 1.20KB
http://forums.tomcoyote.org/style_images/i…e/nav.gif(&H41;) 585 bytes
http://forums.tomcoyote.org/style_images/i…nline.gif(&H41;) 1.29KB
http://m.2mdn.net/viewad/1044445/Purolator…00ppi.gif(&H41;) 2.20KB
http://visitors.workopolis.com/visitor.gif…liate%3D0(&H41;) 43 bytes
http://jobs.workopolis.com/jobshome/db/wor…pi_placement_co
Post #12
Post length is infinite due to long log,please tell how to post.I tried to posts 3 out of 4 logs,failed,then 1 only but a massive MWAV log also failed to paste inside post body.What's remendy.All my day passed in an effort for scanning and pasting.Remedy pls?
Post #13 last edited
I do not need to see the log from ccleaner. The log from the lower pane of mwavscan should not be too large to fit in one post. The top pane shows every file scanned and is not needed. If you still can not fit the mwavscan log from the lower pane to fit in one post, email it to me at click here. Use a subject line of Tom Coyote in the email.

Be sure to post a fresh HijackThis log run from normal mode also.
Post #14
MWAV log in lower pane window:

Object "ElitebarBHO Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "BrowserAid Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "adshooter Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "MediaMotor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "180Solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "BullsEye Network Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cashback Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Roings Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AdRotator Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "CWS.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "D:\WINDOWS\Downloaded Program Files\CONFLICT.4\installer_MARKETING32.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "D:\WINDOWS\Downloaded Program Files\m67m.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\WINDOWS\BBStore\DSS\Dssagent.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Program Files\Netscape\Netscape\plugins\NPSWF32.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\WINDOWS\Downloaded Program Files\m67m.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\WINDOWS\Downloaded Program Files\CONFLICT.4\installer_MARKETING32.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{017C20C1-F86F-11D8-9B25-000ACD002AE3}" refers to invalid object "D:\WINDOWS\Helper101.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0C8903E0-E32F-4035-B798-50C0BBCA42B6}" refers to invalid object "D:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{25192826-28F2-11D5-BD16-004854626FBC}" refers to invalid object "C:\PROGRA~1\NEWTEC~1\NTICD-~1\FILECD\RESFIL~4.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{27395F85-0C0C-101B-A3C9-08002B2F49FB}" refers to invalid object "E:\NCB 10\42-Mobile Tools\SMS 2 SMS\PICCLP32.OCX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{29FF67FF-8050-480f-9F30-CC41635F2F9D}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{33CE799A-0E69-4f81-8F78-E3246771513B}" refers to invalid object "D:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}" refers to invalid object "C:\Program Files\Cheetah Burner\NCTAudioFile2.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5DE57ED1-35D3-40ED-A148-DE2C75FF24B0}" refers to invalid object "D:\Program Files\Norton Internet Security\nisfirstdll.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6628157E-EBAB-4c1d-A3DB-468DB60F890D}" refers to invalid object "D:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6CDBA7CE-C3A4-4548-8D60-118EED9C24A4}" refers to invalid object "D:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6ED74AE3-8066-4385-AABA-243E033F75A3}" refers to invalid object "C:\Program Files\Cheetah Burner\NCTWMAFile2.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}" refers to invalid object "D:\PROGRA~1\Netscape\Netscape\MapiProxy.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{70B51430-B6CA-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{77829F14-D911-40FF-A2F0-D11DB8D6D0BC}" refers to invalid object "C:\Program Files\Cheetah Burner\NCTAudioFile2.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8298d101-f992-43b7-8eca-5052d885b995}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "D:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99EEC57E-4532-4d00-98AB-43D7C8D07755}" refers to invalid object "D:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A1B09066-C95C-4EF6-8DFD-3DD0AFE610B6}" refers to invalid object "D:\PROGRA~1\COMMON~1\AOL\SCREEN~1\YGPSCR~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A8FA2FDE-BF01-4DD9-AAFF-7BACFDCAE896}" refers to invalid object "C:\Program Files\Cheetah Burner\NCTWMAFile2.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A9E69612-B80D-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AA874A22-EB80-11D2-9E74-0010AD28CFA8}" refers to invalid object "D:\PROGRA~1\COMMON~1\SYMANT~1\LIVEAD~1\IraVcMsg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AAFA1E73-4842-4BEC-BC46-48C62E1C5C9C}" refers to invalid object "C:\Program Files\Cheetah Burner\NCTAudioInformation2.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{bada3c15-76d9-45de-87e4-69fff03e2445}" refers to invalid object "D:\WINDOWS\system32\pcduc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C8CE6FC1-CCF1-11D6-B8A5-000064657374}" refers to invalid object "D:\Program Files\Netscape\Netscape\PalmSyncProxy.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CDE0A580-A4A0-4C34-B375-DAB4832FC0AB}" refers to invalid object "D:\WINDOWS\system32\SymNeti.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E13046F7-A5DF-4574-BD7A-6DC12EC10FF5}" refers to invalid object "D:\Program Files\AOL 8.0a\ebrowser.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F1F6A820-2355-11CF-9D53-00AA003C9CB6}" refers to invalid object "E:\NCB 10\42-Mobile Tools\SMS 2 SMS\PICCLP32.OCX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{f612954d-3b0b-4c56-9563-227b7be624b4}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{f9559f75-e9f2-454f-b96c-20763860feaa}" refers to invalid object "D:\WINDOWS\system32\anaun.dll". Action Taken: No Action Taken.
Entry "HKCR\AcroExch.ACMonthViewCtrl" refers to invalid object "{496E3573-32ED-4F18-064E-1810D80B30B0}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Ca.Cas" refers to invalid object "{B5F3970B-745E-46AC-B890-E08F69777D80}". Action Taken: No Action Taken.
Entry "HKCR\Ca.Cas.1" refers to invalid object "{B5F3970B-745E-46AC-B890-E08F69777D80}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\VBRun.VBRunDLL" refers to invalid object "{197B8CA4-E215-46DD-8F33-E0544A80E5C4}". Action Taken: No Action Taken.
Entry "HKCR\VBRun.VBRunDLL.1" refers to invalid object "{197B8CA4-E215-46DD-8F33-E0544A80E5C4}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
File D:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\WINDOWS\cgyoeg.exe tagged as "not-a-virus:AdWare.BetterInternet.c". Action Taken: No Action Taken.
File D:\WINDOWS\system32\redit.cpl infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\GSM3-0511.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\rtneg5_venturahot_246765.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.e". Action Taken: No Action Taken.
File D:\WINDOWS\system32\InstallerV3.exe tagged as "not-a-virus:AdWare.SafeSurfing.j". Action Taken: No Action Taken.
File D:\WINDOWS\system32\weirdontheweb_ventura.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File D:\WINDOWS\system32\L90112201.Stub.exe infected by "Trojan-Downloader.Win32.Delmed.a" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\bsva-egihsg52.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\WINDOWS\COMMAND\EBD\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken.
File C:\WINDOWS\TEMP\GL_3310.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\TEMP\GL_D143.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\TEMP\dia71A2.exe tagged as "not-a-virus:Porn-Dialer.Win32.PluginAccess.gen". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\diaA334.exe tagged as "not-a-virus:Porn-Dialer.Win32.PluginAccess.gen". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\diaF1D5.exe tagged as "not-a-virus:Porn-Dialer.Win32.PluginAccess.gen". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\dia125.exe tagged as "not-a-virus:Porn-Dialer.Win32.PluginAccess.gen". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\dia3226.exe tagged as "not-a-virus:Porn-Dialer.Win32.Generic". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\BI.cab tagged as "not-a-virus:AdWare.BiSpy.o". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\whenu.exe tagged as "not-a-virus:AdWare.SaveNow.ay". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\TNT-WinFax.Pro.10.0_CRK.exe tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
File C:\WINDOWS\TEMP\diaD2D0.exe tagged as "not-a-virus:Porn-Dialer.Win32.PluginAccess". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\GL_E211.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\TEMP\GL_3351.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\TEMP\GL_8123.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\TEMP\GL_E170.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\TEMP\GL_A085.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\TEMP\GL_5274.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\TEMP\THI71BD.TMP\btgrab.cab tagged as "not-a-virus:AdWare.BiSpy.t". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\THI2152.TMP\trebates.cab tagged as "not-a-virus:AdWare.WebRebates.g". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\THI2152.TMP\trebates.exe tagged as "not-a-virus:AdWare.WebRebates.g". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\THI7732.TMP\trebates.cab tagged as "not-a-virus:AdWare.WebRebates.g". Action Taken: No Action Taken.
File C:\WINDOWS\TEMP\THI7732.TMP\trebates.exe tagged as "not-a-virus:AdWare.WebRebates.g". Action Taken: No Action Taken.
File C:\WINDOWS\mruninst.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Common Files\aolback\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Online Services\AT&T\ATTSETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\1BE24CBC.hta infected by "Trojan-Downloader.VBS.Wipup" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\5E062DF3.exe infected by "Trojan-Downloader.Win32.Lexbac.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\5E1D53DA.exe infected by "Trojan-Downloader.Win32.Lexup" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0AC030BC.htm infected by "Exploit.JS.ActiveXComponent" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\10267C71.exe infected by "Trojan-Downloader.Win32.Lexbac.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\10332462.exe infected by "Trojan-Downloader.Win32.Lexup" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4C0C56C2.exe infected by "Trojan-Downloader.Win32.Lexbac.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4C1C28B0.exe infected by "Trojan-Downloader.Win32.Lexup" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\796361F7.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\69582103.exe infected by "Trojan-Downloader.Win32.Lexbac.b" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\7A007733.exe infected by "Trojan-Downloader.Win32.Mendwar" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6C844CDC.exe infected by "Trojan.Win32.Revop.c" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\7C785520.TMP infected by "Virus.VBS.Confi" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\7CA520EE.TMP infected by "Virus.VBS.Confi" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\07BB26BB.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0A421FF3.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0A5945DA.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0A9D378F.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0B092118.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\18C6159F.TMP infected by "Virus.VBS.Confi" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\19522304.TMP infected by "Virus.VBS.Confi" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\39EE25FB.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3A0B1FDB.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3A50118F.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3AE61CEA.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3AFA18D4.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3CD036CF.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3D142883.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3D215075.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\72CB5E5D.TMP infected by "Virus.VBS.Confi" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\72D8064F.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\73B3035E.TMP infected by "Virus.VBS.Confi" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\73BC0153.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\74FC13F3.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\754105A7.TMP infected by "Virus.VBS.Redlof.a" Virus! Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6AA875D1 infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.01. No Action Taken.
File C:\Program Files\Real\RealOne Player\RealOne.exe tagged as not-a-virus:Tool.Win32.TPE.a. No Action Taken.
File C:\unzipped\Nailfix\Nailfix\Process.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.
File C:\hol39877995.exe tagged as "not-a-virus:Porn-Dialer.Win32.Holistyc.gen". Action Taken: No Action Taken.
File D:\WIN98\WIN98_64.CAB tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\WINDOWS\system32\Cache\pi1_60.exe infected by "Trojan-Downloader.Win32.Small.aal" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\Cache\optimize8.exe infected by "Trojan-Downloader.Win32.Dyfuca.ei" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\Cache\876004.exe infected by "Trojan-Dropper.Win32.VB.gg" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\Cache\e121307.Stub.exe infected by "Trojan-Downloader.Win32.Delmed.a" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\Cache\setupone.exe infected by "Trojan-Downloader.Win32.VB.id" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\Cache\kvm_bsvb-eginwl52.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File D:\WINDOWS\system32\redit.cpl infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\GSM3-0511.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\rtneg5_venturahot_246765.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.e". Action Taken: No Action Taken.
File D:\WINDOWS\system32\InstallerV3.exe tagged as "not-a-virus:AdWare.SafeSurfing.j". Action Taken: No Action Taken.
File D:\WINDOWS\system32\weirdontheweb_ventura.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File D:\WINDOWS\system32\L90112201.Stub.exe infected by "Trojan-Downloader.Win32.Delmed.a" Virus! Action Taken: No Action Taken.
File D:\WINDOWS\system32\bsva-egihsg52.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File D:\WINDOWS\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\WINDOWS\cgyoeg.exe tagged as "not-a-virus:AdWare.BetterInternet.c". Action Taken: No Action Taken.
File D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QMem0612200516525732468.asw tagged as "not-a-virus:AdWare.WebSearch.ap". Action Taken: No Action Taken.
File D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QMem0612200516525734203.asw tagged as "not-a-virus:AdWare.WebSearch.an". Action Taken: No Action Taken.
File D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QMem0612200516525734250.asw infected by "Trojan-Clicker.Win32.Small.et" Virus! Action Taken: No Action Taken.
File D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003688406.asw infected by "Trojan-Clicker.Win32.Small.et" Virus! Action Taken: No Action Taken.
File D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003688437.asw tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034423140.asw tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QMem06152005133922621984.asw tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
File D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QMem06152005133922622343.asw tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File D:\Program Files\Common Files\aolback\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File D:\Program Files\AOL 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Program Files\FYI\kqpafwhjut.dll tagged as "not-a-virus:AdWare.SmartPops.d". Action Taken: No Action Taken.
File D:\Program Files\FYI\kqpafwhjut.exe tagged as "not-a-virus:AdWare.SmartPops.c". Action Taken: No Action Taken.
File D:\Program Files\AOL 9.0a\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Program Files\Internet Optimizer\optimize.exe infected by "Trojan-Downloader.Win32.Dyfuca.ei" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP1\A0000031.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP1\A0000032.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP3\A0000127.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP5\A0000375.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP5\A0000379.exe tagged as "not-a-virus:Dialer.Win32.PlayGames". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP5\A0000485.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000496.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000506.exe tagged as "not-a-virus:Dialer.Win32.PlayGames". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000508.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000513.exe tagged as "not-a-virus:AdWare.BetterInternet.c". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000525.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000529.exe tagged as "not-a-virus:AdWare.BetterInternet.c". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000531.exe tagged as "not-a-virus:Dialer.Win32.PlayGames". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000534.exe tagged as "not-a-virus:Dialer.Win32.PlayGames". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000543.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000550.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000560.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000563.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000566.dll infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000567.cpl infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000568.exe infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000569.exe infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000570.dll infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000571.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000615.EXE infected by "Trojan-Downloader.Win32.Qoologic.o" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000616.DLL infected by "Trojan-Downloader.Win32.Qoologic.q" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000626.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000629.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000633.EXE infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000686.EXE infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000687.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000777.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000779.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000802.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000803.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0000804.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0001818.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0001819.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP6\A0001821.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP7\A0001839.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP7\A0001840.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP7\A0001842.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP8\A0001872.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP8\A0001881.dll tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP8\A0001889.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP8\A0001890.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002035.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002036.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002037.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002038.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002039.dll tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002051.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002052.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002053.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002054.dll tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002132.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002133.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002134.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0002135.dll tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0003132.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0003133.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0003134.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0003136.dll tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0003169.dll tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0003170.dll tagged as "not-a-virus:AdWare.SafeSurfing.j". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0003172.dll infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP10\A0003179.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003219.exe infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003236.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003237.exe tagged as "not-a-virus:AdWare.DelphinMediaViewer.f". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003238.exe infected by "Trojan-Dropper.Win32.Small.wc" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003239.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003240.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003241.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003242.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003243.dll infected by "Trojan-Downloader.Win32.Qoologic.p" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003244.srg tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003245.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.e". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003246.DLL tagged as "not-a-virus:AdWare.SafeSurfing.j". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003247.exe tagged as "not-a-virus:AdWare.SafeSurfing.i". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003248.exe tagged as "not-a-virus:Dialer.Win32.PlayGames". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003249.exe infected by "Trojan-Spy.Win32.VB.eh" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003250.exe infected by "Trojan-Dropper.Win32.Small.wc" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003251.exe infected by "Trojan-Spy.Win32.VB.eh" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003252.dll infected by "Trojan-Downloader.Win32.Braidupdate.d" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003253.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003254.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003263.exe infected by "Trojan-Downloader.Win32.Small.aly" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003266.dll tagged as "not-a-virus:AdWare.ToolBar.SearchIt.d". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003273.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003289.exe infected by "Trojan.Win32.Favadd.o" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003290.exe infected by "Trojan-Downloader.Win32.Small.hs" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003291.dll infected by "Trojan-Clicker.Win32.Delf.r" Virus! Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003292.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003293.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP12\A0003294.exe tagged as "not-a-virus:AdWare.EZula.ah". Action Taken: No Action Taken.
File D:\System Volume Information\_restore{FBFBCE06-979D-4D44-A3EF-E11E42CAD461}\RP13\A0003480.exe infected by "Trojan.Win32.Registrator.b" Virus! Action Taken: No Action Taken.
File D:\FOUND.011\FILE0001.CHK infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File D:\COMPROB\backups\backup-20050618-234529-621.dll tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File D:\COMPROB\backups\backup-20050618-234530-494.dll tagged as "not-a-virus:AdWare.SafeSurfing.j". Action Taken: No Action Taken.
File D:\COMPROB\backups\backup-20050618-234530-176.dll tagged as "not-a-virus:AdWare.ReSearch.a". Action Taken: No Action Taken.
File D:\COMPROB\backups\backup-20050618-234530-287.dll infected by "Trojan.Win32.StartPage.yq" Virus! Action Taken: No Action Taken.
File D:\COMPROB\Nailfix.zip tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.

Logfile of HijackThis v1.99.1
Scan saved at 10:16:46 AM, on 6/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\ewido\security suite\ewidoguard.exe
D:\WINDOWS\system32\wfxsnt40.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe
D:\Program Files\QuickTime\qttask.exe
D:\WINDOWS\System32\igfxtray.exe
D:\WINDOWS\System32\hkcmd.exe
D:\Program Files\Zero Knowledge\Freedom\Freedom.exe
D:\WINDOWS\System32\svchost.exe
D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
D:\WINDOWS\system32\rkmpkk.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\hotfoon4.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Adobelm_Cleanup.0001
D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\AOL Companion\companion.exe
D:\Program Files\Common Files\Command Software\dvpapi.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\COMPROB\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://groups-beta.google.com/group/24hoursupport.helpdesk
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [msnappau] "D:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Freedom] D:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [DownloadAccelerator] D:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [CallControl 4.5] D:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [AOL Spyware Protection] "D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\rkmpkk.exe reg_run
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Babylon Translator] D:\Program Files\Babylon\Babylon.exe
O4 - HKCU\..\Run: [HOTFOON2] D:\Program Files\hotfoon4.exe /h
O4 - Global Startup: AOL Companion.lnk = D:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = D:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - D:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - D:\WINDOWS\system32\WFXSVC.EXE
Post #15
Step 1
Open Norton Antivirus and click reports. In quarantined items click "view report" and in the window that opens click Quarantined Items. Highlight each line in the left column and click Delete Item from the toolbar above. Repeat this procedure for the Backup Items.


Step 2
Click on this link http://www.downloads.subratam.org/KillBox.zip to download Pocket Killbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it.
Start Killbox and click on Tools < Delete Temp Files. When that finishes, copy and paste each of the following lines into the Full Path of File to Delete box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

D:\WINDOWS\cgyoeg.exe
D:\WINDOWS\system32\redit.cpl
D:\WINDOWS\system32\GSM3-0511.exe
D:\WINDOWS\system32\rtneg5_venturahot_246765.exe
D:\WINDOWS\system32\InstallerV3.exe
D:\WINDOWS\system32\weirdontheweb_ventura.exe
D:\WINDOWS\system32\L90112201.Stub.exe
D:\WINDOWS\system32\bsva-egihsg52.exe
C:\WINDOWS\TEMP\dia71A2.exe
C:\WINDOWS\TEMP\diaA334.exe
C:\WINDOWS\TEMP\diaF1D5.exe
C:\WINDOWS\TEMP\dia125.exe
C:\WINDOWS\TEMP\dia3226.exe
C:\WINDOWS\TEMP\BI.cab
C:\WINDOWS\TEMP\whenu.exe
C:\WINDOWS\TEMP\TNT-WinFax.Pro.10.0_CRK.exe
C:\WINDOWS\TEMP\diaD2D0.exe
C:\WINDOWS\TEMP\THI71BD.TMP\btgrab.cab
C:\WINDOWS\TEMP\THI2152.TMP\trebates.cab
C:\WINDOWS\TEMP\THI7732.TMP\trebates.exe
C:\hol39877995.exe
D:\WINDOWS\system32\Cache\pi1_60.exe
D:\WINDOWS\system32\Cache\optimize8.exe
D:\WINDOWS\system32\Cache\876004.exe
D:\WINDOWS\system32\Cache\e121307.Stub.exe
D:\WINDOWS\system32\Cache\setupone.exe
D:\WINDOWS\system32\Cache\kvm_bsvb-eginwl52.exe
D:\WINDOWS\cgyoeg.exe
D:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe
D:\Program Files\FYI\kqpafwhjut.dll
D:\Program Files\FYI\kqpafwhjut.exe
D:\Program Files\Internet Optimizer\optimize.exe
D:\FOUND.011\FILE0001.CHK
D:\WINDOWS\system32\rkmpkk.exe

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


Step 3
Open HijackThis, run a scan, then check the following:

O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\rkmpkk.exe reg_run
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)

With all other programs and browsers closed, click fix checked.


Step 4
Please delete the following folder:

D:\Program Files\Internet Optimizer


Step 5
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include a new mwavscan log as well.
Please let us know of any complications you had and how the computer is behaving.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI