Spyware / Malware / Virus Removal

about:blank - Trek Blue infection

5 min read

Looking for the outcome? Ask AI

canoeman Topic Starter

Post #1July 7, 2005, 8:46 PM UTC

Yesterday I was using Internet Explorer and things got weird. My home page was set to about:blank, among other things. I've been using Firefox since.

I ran Spybot and it cleaned up a bunch of things, but it could not get rid of Trek Blue. It suggested I allow Spybot to run on restart, which I did several times but it could never get rid of Trek Blue. I also tried AdAware-SE without success.

I saw a similar post, and I've downloaded/updated CWShredder , About Buster, and HSfix.zip but have not used them.

Here is a HijackThis log which I created after a reboot. Any pointers appreciated. Apologies upfront if I'm not doing this right, I've read the directions but this is my first time (and hopefully the last).

Thanks.

—

Logfile of HijackThis v1.99.1
Scan saved at 6:35:01 AM, on 7/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\apptg32.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Real\RealOne Player\RealPlay.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Sparky\Application Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Sparky\Application Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar2.dll
O2 - BHO: Class - {D04B13F5-0E39-EE4E-D33A-14F3941F8539} - C:\WINDOWS\system32\d3nk.dll
O2 - BHO: YBIOCtrl Class - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dll
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [apptg32.exe] C:\WINDOWS\apptg32.exe
O4 - HKLM\..\RunOnce: [appfr32.exe] C:\WINDOWS\appfr32.exe
O4 - HKCU\..\Run: [cnet] "C:\Program Files\Kontiki\bin\kontiki.exe" -s cnet -q
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\hcm.exe" -w
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1095374163859
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (YBIOCtrl Class) - http://us.dl1.yimg.com/download.yahoo.com/…bar/yiebio4.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SystemSuite Task Manager - Ontrack Data International - C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

LDTate

Post #2July 15, 2005, 11:34 PM UTC last edited July 15, 2005, 11:36 PM UTC

Hello canoeman, welcome to the TC.

It's better to print out the next instructions or save it in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then.
It is also important you don't miss a step and perform everything in the right order!!

First of all, I want you to download and install another browser, because for the moment I strongly suggest NOT to use Internet Explorer, because everytime you open it, new malware is getting downloaded.
So, I want you to use Firefox instead to browse the web.
When your system is clean again, you can use your IE again.
Here you can find firefox to download: http://www.mozilla.org/products/firefox/

°Download AboutBuster.
http://www.besttechie.net/tools/AboutBuster5.zip

Unzip AboutBuster in an own folder such as C:\AboutBuster.
Start AboutBuster.exe. Click OK, Update, Check For Update and download the updates if present.
Close aboutbuster now, because you may not run it yet, that's for later.
If You are getting an error when updating, please let me know first before you proceed with the next steps.

* Download and install CCleaner
http://www.ccleaner.com/

Do not use it yet.

* Download CWShredder.
http://cwshredder.net/bin/CWShredder.exe
Don't let it run yet!

* Download this regfix: HSfix
http://users.pandora.be/marcvn/tools/HSfix.zip
Unzip it and place it on your desktop, don't use it yet!

* Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

°First, we will make your hidden files and folders visible.
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Uncheck the Hide file extensions for known file types.
* Click Yes to confirm.
* Click OK.

open notepad and copy and paste next bold in it:
(do not forget to copy and paste REGEDIT4 in it!)

REGEDIT4

[-KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

Save this as fix.reg , choose to save as *all files and place it on your desktop.

*Please reboot your system into SAFE MODE.
°To get into the Windows XP Safe mode as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu". Use your arrow keys to move to "Safe Mode" and press your Enter key.

Doubleclick on fix.reg you made before and when it asks you if you want to add the contents to the registry, click yes/ok

*Start hijackthis and click scan and put a checkmark next to the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\yplmx.dll/sp.html#93256

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {D04B13F5-0E39-EE4E-D33A-14F3941F8539} - C:\WINDOWS\system32\d3nk.dll

O2 - BHO: Class - {F74F518E-7A1A-8A18-680D-862855C2B032} - C:\WINDOWS\mfctt.dll

O4 - HKLM\..\Run: [apptg32.exe] C:\WINDOWS\apptg32.exe

O4 - HKLM\..\RunOnce: [appfr32.exe] C:\WINDOWS\appfr32.exe

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe

*Close all open windows except hijackthis and click 'Fix Checked'.

*Go to start >run and type: services.msc and click OK
Scroll down in that list and look if the following services are present:

Network Security Service (NSS)
Remote Procedure Call (RPC) Helper
Workstation NetLogon Service

Please make sure it is exactly the same written as above, because there are also legit services that look very the same as the ones above, so please choose the right one!! For example, there's also a legit service called Remote Procedure Call (RPC), without the word Helper in it. That is a good one, so please don't select that one.

Doubleclick on it. In the window that will appear, click on "Stop" (if not greyed out) and change the Startup Type to disabled.
Click apply and OK and close all open windows.

*Start Aboutbuster and let it scan. When the scan is done and you choose exit, it will automatically create a log in the same folder where aboutbuster is in.

*Start Cwshredder and click FIX

* Doubleclick on HSfix you downloaded earlier before which is present on your desktop and when it asks you if you want to add the contents to the registry, click yes/ok

* Still in safe mode Run Ccleaner and click Run Cleaner (bottom right)

* Now open Ewido Security Suite
Click on scanner

* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop

Close Ewido

*Go to start>Control Panel>Internet Options>tab programs> and click restore websettings.

* Reboot your PC back to normal.

* Perform an onlinescan with Bitdefender and/or Housecall (check here autodelete) and let it delete everything it is finding.

*Post a new hijackthis-log + log from ewido and log from aboutbuster which you'll find in the aboutbuster-folder

Note:
Credit to miekiemoes, for most of this fix.

canoeman

Post #3July 16, 2005, 6:13 PM UTC

Thanks LD. I've completed your instructions and the system rebooted and is

usable!! There are some problems, but at least I'm not dead in the water

which I feared.

NOTES:

I've been using only Firefox since this happened. That will be my default

browser from now on. I've also disconnected my cable modem whenever not in

use. Think I'll buy a hardware firewall to supplement my Zonealarm.

The fix.reg did not run the first time - I did a cut and paste from your post

to a notepad file, and it puts in a couple of blank lines. I tried removing

them and that fixed the problem.

When I ran hijackthis with "Fix Checked", it did not find a couple (the O2 -

BHO: Class ones), but I've had to reboot a couple of times since I first

posted a log.

When CWshredder completed, it said I would have to reboot for it to finish.

I did not reboot since it wasn't in your instructions, which seemed to

continue in safe mode.

EWIDO found about 4000 objects, many of them in WINDOWS and WINDOWS\System32.

When I rebooted the system, over 1000 files in those directories could not

be found. I was sweating it as I had to hit "continue" for each of those

files during the reboot, but the system did come up. I'm hesitant to reboot

again.

I started Firefox and went to the Housecall webpage. It told me it only

supported IE. I tried to execute IE, but iexplore.exe could not be found. I

used Bitdefender instead.

When I tried to open a wps file (I have MS Works), that errored out also. I

was just about to order the full version of Office (I have a deal on it)

anyway.

Here are the logs from Hijackthis (after my reboot) and AboutBuster (before reboot). The EWIDO log was several thousand lines long and I could not post it complete. I've noted where I made deletions of what seemed like similar-type lines.

Thanks,
C-Man

Hijackthis—————————–
Logfile of HijackThis v1.99.1
Scan saved at 1:15:57 PM, on 7/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender8\vsserv.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdswitch.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://my.netzero.net/s/search?r=minisearch
N3 - Netscape 7: user_pref("browser.startup.homepage",

"http://www.google.com/"); (C:\Documents and Settings\Sparky\Application

Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine",

"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5C

SBWeb_01.src"); (C:\Documents and Settings\Sparky\Application

Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -

c:\windows\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -

c:\windows\googletoolbar2.dll
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft

Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone

Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program

Files\Softwin\BitDefender8\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program

Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [cnet] "C:\Program Files\Kontiki\bin\kontiki.exe" -s cnet

-q
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\hcm.exe" -w
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program

Files\Microtek\ScanWizard 5\ScannerFinder.exe
O8 - Extra context menu item: &Google Search -

res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -

res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -

res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality -

res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality -

res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages -

res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -

res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration

Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://v5.windowsupdate.microsoft.com/v5co…/x86/client/wuw

eb_site.cab?1095374163859
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} -

http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield

International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (YBIOCtrl Class) -

http://us.dl1.yimg.com/download.yahoo.com/…bar/yiebio4.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program

Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file

missing)
O23 - Service: DefWatch - Symantec Corporation - C:\Program

Files\NavNT\defwatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program

Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program

Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec

Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SystemSuite Task Manager - Ontrack Data International -

C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\System32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program

Files\Softwin\BitDefender8\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program

Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service

(file missing)

AboutBuster log ———————————————————
AboutBuster 5.0 reference file 30
Scan started on [7/16/2005] at [9:55:43 AM]
————————————————
Removed Stream! C:\WINDOWS\001231_.tmp:otgwl
Removed Stream! C:\WINDOWS\AMS2INST.LOG:qustr
Removed Stream! C:\WINDOWS\cdplayer.ini:bvveo
Removed Stream! C:\WINDOWS\clock.avi:ugjav
Removed Stream! C:\WINDOWS\comsetup.log:bczzq
Removed Stream! C:\WINDOWS\Greenstone.bmp:enegm
Removed Stream! C:\WINDOWS\ImportClient.INI:cqicp
Removed Stream! C:\WINDOWS\KB821253.log:masth
Removed Stream! C:\WINDOWS\KB823559.log:tztqk
Removed Stream! C:\WINDOWS\KB823980.log:merih
Removed Stream! C:\WINDOWS\KB834707.log:oozrz
Removed Stream! C:\WINDOWS\KB840315.log:fuqcs
Removed Stream! C:\WINDOWS\KB840374.log:dntga
Removed Stream! C:\WINDOWS\KB873333.log:xtsow
Removed Stream! C:\WINDOWS\KB885250.log:ygmvh
Removed Stream! C:\WINDOWS\KB885836.log:shbsj
Removed Stream! C:\WINDOWS\KB886185.log:sweqj
Removed Stream! C:\WINDOWS\KB887742.log:ufrmy
Removed Stream! C:\WINDOWS\KB888302.log:yumpa
Removed Stream! C:\WINDOWS\KB890175.log:hmqgd
Removed Stream! C:\WINDOWS\KB890859.log:yefxem
Removed Stream! C:\WINDOWS\KB890923.log:wuwcx
Removed Stream! C:\WINDOWS\KB893086.log:nidlb
Removed Stream! C:\WINDOWS\LUINSTALL.LOG:duphf
Removed Stream! C:\WINDOWS\ModemLog_Dell Data Fax Modem.txt:plear
Removed Stream! C:\WINDOWS\ModemLog_MDP3880-W(U) PCI Modem.txt:fheqh
Removed Stream! C:\WINDOWS\msdfmap.ini:cobsq
Removed Stream! C:\WINDOWS\ngmyr.log:gwsac
Removed Stream! C:\WINDOWS\ocgen.log:lqkxq
Removed Stream! C:\WINDOWS\orun32.ini:sclob
Removed Stream! C:\WINDOWS\ps-rc4s.bmp:nbood
Removed Stream! C:\WINDOWS\Q309521.log:luwng
Removed Stream! C:\WINDOWS\Q314147.log:clwyi
Removed Stream! C:\WINDOWS\Q314862.log:ybtun
Removed Stream! C:\WINDOWS\Q318966.log:tcnqa
Removed Stream! C:\WINDOWS\Q319580.log:urdog
Removed Stream! C:\WINDOWS\Q323255.log:zysnn
Removed Stream! C:\WINDOWS\Q328310.log:ooebv
Removed Stream! C:\WINDOWS\Q329170.log:uvlmv
Removed Stream! C:\WINDOWS\Q329390.log:qpccv
Removed Stream! C:\WINDOWS\Q814033.log:eukaf
Removed Stream! C:\WINDOWS\Q819696.log:gznyb
Removed Stream! C:\WINDOWS\qnsab.dat:afvmn
Removed Stream! C:\WINDOWS\rcbod.dat:euedv
Removed Stream! C:\WINDOWS\REGLOCS.OLD:kfhrv
Removed Stream! C:\WINDOWS\Rhododendron.bmp:fsszh
Removed Stream! C:\WINDOWS\SBPCI.bmp:hwpnr
Removed Stream! C:\WINDOWS\SchedLgU.Txt:foxqj
Removed Stream! C:\WINDOWS\setuplog.txt:oqvns
Removed Stream! C:\WINDOWS\system.ini:xlhnf
Removed Stream! C:\WINDOWS\Thumbs.db:encryptable
Removed Stream! C:\WINDOWS\tsoc.log:hqqws
Removed Stream! C:\WINDOWS\VPC32.INI:skefg
Removed Stream! C:\WINDOWS\winnt256.bmp:gictw
Removed Stream! C:\WINDOWS\wmsetup10.log:hthmp
Removed Stream! C:\WINDOWS\WMSysPrx.prx:zmtqt
Removed Stream! C:\WINDOWS\Zapotec.bmp:lecfuz
Removed Stream! C:\WINDOWS\_default.pif:aapxd
————————————————
Removed File! : C:\Windows\cwxaw.dat
Removed File! : C:\Windows\System32\yplmx.dll
————————————————
Scan was COMPLETED SUCCESSFULLY at 10:08:09 AM

EWIDO log————————————————————
———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 12:19:55 PM, 7/16/2005
+ Report-Checksum: 8A709CA0

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{00AF6BF7-1C8A-2F68-11A6-3DD4FD5A3DED} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{04256906-BECE-83AC-2058-27ABA38B11A3} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{04D2569C-ED83-79FB-0E43-F43DFA258774} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{04EDA6A5-3C09-E146-8F75-5684DDB4E2A7} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{05C2ECE7-AB9F-8750-F571-7DD76F135929} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{05CFF62B-F8EF-A6A3-C2D8-0649EE07F197} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0661C16F-8ED8-1431-8A0B-2C95C6994589} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{07D80144-9372-FEAC-AEDD-21AE8732F067} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{07F0CAA0-8206-9DCC-5402-D4CC24EC1764} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0AD1A770-F33D-516E-A6BD-A3AEB8568EAC} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0B4F9B2C-F81D-7C42-AE33-07F0FCB846EC} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0B538AE6-8676-E13B-4CEC-E6A75F19F1EF} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0E37D9E0-99E3-DA14-3197-60132338963E} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{10D837D7-D6EA-8BCE-37FB-E58A2E09397B} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1228458E-6B19-48F4-5449-A00AEE93F0FC} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{12FA3D1E-6BB1-A968-D251-242CE33A798A} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1323178D-09E3-B628-CC3A-95630B64B7DA} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{155F178D-1B07-52BD-BF72-827F24ED9DCE} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1674BCBE-46DE-7BAB-FBFA-CA15D9FEB632} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{18DF9808-F6C9-984B-EDE3-0B7624EC452A} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1B9CEE94-E0D7-13CF-2DA8-CA3C766EAAD0} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1BD83F34-5674-FA0D-E5B2-7D7655F0D46F} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1F5650BA-2C95-0E8C-5C3F-D482646BF979} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{24E10FF7-10AA-6198-95AE-258D49D9ABCA} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{25742C0F-DC0D-F5DC-55DE-C66285AA22AB} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{26F5CDB0-3ADD-70F3-F30F-8DD2B92D52FF} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{29B25401-5964-022D-3AC2-C7207FEFF994} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{29CDA41A-A8EB-6A68-BBF5-2877418D55C7} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2A6A2EFF-2FC6-683C-5911-BB1AC07E5964} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2A97DB56-E2B4-967C-AF9F-07FDF74289C2} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2A9B7B46-3BB6-BB3C-9E0A-6C988B9DE22E} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2BFAB072-A3F3-0A97-6990-3673392B7DFC} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2D7C78D3-F49A-8BD3-9A98-41F319D802B2} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2D99FD34-F395-DFB0-0852-36D4976F6E3D} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{3061EF1C-F3C8-2DAB-24E0-C96288EB621D} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{30C5202D-2CDD-8C6D-6CD3-86CBAC73988B} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{30E36B0A-CA1D-18E7-7FD2-9BA91D4D1710} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{32FB9A97-C47A-795A-3B47-9A97C1448DFC} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{33EBB320-A2D5-6FD7-6D31-BA458C872ABD} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{36846EB6-C1B1-A145-B3CE-F5740FA22FF8} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{36A41F9E-B433-C078-89AE-486D2624C972} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{38A09FC8-FCAF-3D1E-A6D6-FB0A0E2E2D98} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{3BA763E9-3208-0CD2-31BD-37026D1B8537} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{44A4F449-ADED-A513-8AE7-5A3DDF205F49} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{47B70B6F-A6B0-230A-43C3-9F9B5C710209} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{4B3176F0-E32F-B010-C0D8-65FC118C3716} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{50B9D537-5DB0-52B1-FF6F-ED6C70DA477E} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{52CA0FCE-F9E0-2125-6CA6-2627141A47E9} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5345A51F-E5D0-5A0D-1418-A1C95C417E3C} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{57CEBAAD-4565-C660-5FAF-624E13DBE3B7} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5B7E5C2F-7668-51A3-BA8C-F6B376755AF9} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5BCC3EE7-9153-E89F-6D4E-9B02B02B4E2E} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5DA6CA48-7D98-BC0B-40EF-22AC6558668A} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5E60DAD4-D59A-D1EA-A0B3-BD226EE43523} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5F1C7FC6-359E-6D58-42B3-3E410DB4CADB} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5F32646E-6D3E-257C-2369-EFD1A3A012F8} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5F574346-A206-D78A-7149-4C709D5204A4} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5FA0CF1E-5FF7-5212-6D7D-5710E683BABB} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{62B52B4D-547B-BFC7-9850-79709FDECF27} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{64770A00-0C3B-BCEC-D32D-83EE61896228} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{651214D8-15FD-F7BB-3AF2-BA7967C08710} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{66DEB589-B6D4-E95E-2E36-26287464CD11} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{677E5988-9E47-B4BE-8002-B86CEAD32154} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{67A0E5DD-D21D-3F1C-2FD5-07C50B27B4BD} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{67D02480-710B-80D7-0624-27BB57B32CDE} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{68005AEB-2632-F033-B29F-EA21C446CA22} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{69A88C5E-04E5-741D-6CA2-9CB5374EB263} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6A493714-8012-621E-A09E-CD80FF52FB1F} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6DDF3AF2-CB9D-199D-044C-9941E91E7CFF} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{71476230-0B89-E69D-D223-279F989C21BB} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{72877DD4-A7A3-8B9D-DEB7-F09CC0629D54} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{765369C1-D4E0-D6A4-69B4-6261D4E1319A} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{78CA5367-0660-D7DE-5424-C4AD26542538} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{792E2C95-AEBD-D9B8-E958-AD1BB5A3D9BA} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{794DE92B-5B3E-DFB3-BD79-2505954D24D5} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{795714A8-C9C0-E8BD-30DB-A0DA3B603993} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{7C36455F-C2B4-5BC0-575A-253825413F0C} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{7DA446BF-5485-78F9-CC9A-2A02C93519E4} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{7DFA112F-21B6-72CE-A5DE-09FEAF22C151} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{7E2B347A-52AA-597F-9371-80822A8D1263} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8007F30A-ADD5-7E61-D29C-8F166BC8A3DD} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8169E4D3-2914-C956-AAFE-F49D78C929A8} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{826D0369-102B-4A44-F27B-D9DCC50A8EE6} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8324D4AA-9FD0-5334-D040-C3B82F9A8957} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{865E2CEC-DCDC-CF30-C932-8A491F233655} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{86B29A5F-CB91-3C3D-28A2-EDA38C1F28A8} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8735EBDB-E5CE-D8EC-D853-7210E5BC2584} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8A50C2FE-C00E-0C19-DC1A-BCABABE155C3} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8D01C3C9-547A-12EE-5401-4B29F8F98176} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8F60435F-DF74-6308-E8CB-509D69906821} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{905BD5E4-261C-4EFD-5456-CD124D7B9D18} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{952B27F0-D129-A966-5DF7-9E2D52C7E338} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{966FA744-197F-E95E-EB31-73BE39619DE2} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{9913F006-5621-D9B4-E3CB-064477E8D278} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{9C060FC3-F4CE-894D-8EB7-FA3935CE5AA1} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A0B249A8-05AF-32B0-992B-DB1CAFDEB3E4} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A167704A-0F01-8543-16A8-ECF3EBA5DC01} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A1BC7CDD-070B-7E5C-FEAD-F4789795AD1A} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A1BD0D9E-655B-CB60-6F75-1DFC720AEAB9} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A3B9B534-33C7-F4A9-994E-4A8BFD538322} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A4405AD1-A13C-E10B-4B57-D5092B102F2B} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A45C982E-5E8A-94C9-33A0-1F6E1789AC7E} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A6A537E1-A69B-6C58-00AC-B6C4E8539037} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A72CAEB7-7E44-7941-564B-A741D28B01DB} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A7737E2C-9C15-D4BE-4A5B-C15B7E8C41E9} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A94D3AA0-A235-876E-2DCD-617E08BD8301} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A97B64CA-35C4-DD86-2890-054EE94CE844} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{AAC06F6E-F261-4E44-CF1D-B1EA9712EF4B} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{ABFF8236-DCBD-E17B-0A69-6FD85FA199FE} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B1169ABC-E367-2937-9F96-3B9CB54E0F31} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B2E28203-4884-D849-F129-5F1A3C2A59D2} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B30EFD56-F6AF-2F6B-C3AB-6571E5627F1F} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B5872D9A-BAAF-EE65-E0A0-6D49EFD1D166} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B595A235-53A2-27D5-EFF6-D0208801D071} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B6E89CAB-169D-C0D8-F8D0-4EB58B02ABAB} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B7ABD257-6E0C-E7F0-26F5-0315127E44C2} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{BA5E5B3E-BB1D-2938-3E93-1C81F766E7AB} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{BCA18F7D-4CAB-D300-286E-432722FFB0FB} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{BD00AB82-F105-58F8-2B31-B600383177E6} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C092CEA0-FB34-5E12-83ED-47942941DECC} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C3CBD491-14A8-F1D3-52CC-F2038BD5FDDE} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C6986041-AF54-9AEF-5EA0-8C5C69D8DEB3} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C75B8795-6012-883F-06EE-5F1501763CFE} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C9368290-DE0B-80FF-0E2D-8933F6CA1A46} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{CC6B2B65-2D60-CC2D-B4A6-7C0945964771} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D063E7A9-F6B2-80F8-44B2-F8210FDEDF67} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D0EFC5AD-B041-13C1-482F-CF46EFEFF6C3} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D27DD7B4-A72B-4B66-2BD3-262B793A3C2C} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D605EAFF-2C3A-4619-43C1-4FFB062F68DE} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D75B9D6B-FB2A-EE40-24DA-791D27C77147} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D847DBFE-4EE2-AF6C-D202-0D9795B9D820} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D85FBAA5-5F33-6173-D800-EFD4E38AE63E} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DABFF8C3-DF48-F11C-290D-D7CD732B35CC} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DB054D56-EEA3-C985-BEDB-3E646A49FA44} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DC690906-09E2-710F-7C3B-F2F819B49B2A} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DCF499B3-5BE2-6F3F-B6C8-FB0597F0FF79} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DD25AEF3-3DC7-625D-F3C6-DE10B7C6BF82} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DE2D7676-D3B6-1EDB-60CA-DA72D6F9B006} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{E5AEC6A2-E0DA-BCCF-46E8-C8D57F1BAB09} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EA8D7DFA-04BF-99E7-595C-535DC7F0EFBA} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EAB9C89C-A224-B071-97DC-24A78995DD29} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EBB942DD-6CAD-83C9-BB7A-1A229122535B} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EDB7FF48-2CC7-7131-A993-53C8F83DD550} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EE5F21BB-197A-041B-53A6-055C6B35DD91} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EE72D9B5-81C8-E738-8F1C-E3D4FED74E0D} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F2255AF4-092C-0BF6-52CF-8484B194FCC4} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F22C21C3-2FA8-F0A7-72B3-7927ADEFC66E} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F2903213-C2D0-B852-F56D-8B10D6C8C121} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F7B868F8-EA98-86A3-D29E-5BCE94E2DD6A} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F80F0D50-2D6C-75C3-606A-3DFE0F4FC5D0} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FC92C3DE-F786-C2A4-4565-359ECF140E14} ->

Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FE0CF482-D7A9-BD18-0056-CF55E4EDD446} ->

Spyware.CoolWebSearch : Cleaned with backup

HKU\S-1-5-21-3402799377-1499398264-598665437-1005\Software\Microsoft\Windows\

CurrentVersion\Ext\Stats\{316D6034-8672-118C-728F-D9D78EFEA265} ->

Spyware.CoolWebSearch : Cleaned with backup

HKU\S-1-5-21-3402799377-1499398264-598665437-1005\Software\Microsoft\Windows\

CurrentVersion\Ext\Stats\{651214D8-15FD-F7BB-3AF2-BA7967C08710} ->

Spyware.CoolWebSearch : Cleaned with backup

HKU\S-1-5-21-3402799377-1499398264-598665437-1005\Software\Microsoft\Windows\

CurrentVersion\Ext\Stats\{794DE92B-5B3E-DFB3-BD79-2505954D24D5} ->

Spyware.CoolWebSearch : Cleaned with backup

HKU\S-1-5-21-3402799377-1499398264-598665437-1005\Software\Microsoft\Windows\

CurrentVersion\Ext\Stats\{C8ECE32F-6478-B278-BA63-C2FD89E2DCF5} ->

Spyware.CoolWebSearch : Cleaned with backup

HKU\S-1-5-21-3402799377-1499398264-598665437-1005\Software\Microsoft\Windows\

CurrentVersion\Ext\Stats\{CAFF6042-9822-36A6-4764-C0BF5E59EF31} ->

Spyware.CoolWebSearch : Cleaned with backup

HKU\S-1-5-21-3402799377-1499398264-598665437-1005\Software\Microsoft\Windows\

CurrentVersion\Ext\Stats\{E5AEC6A2-E0DA-BCCF-46E8-C8D57F1BAB09} ->

Spyware.CoolWebSearch : Cleaned with backup
C:\WINDOWS\addaa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addal32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addax32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\adday.exe -> Trojan.Agent.bi : Cleaned with backup
========Deleted several hundred similar lines================
C:\WINDOWS\Apsetup.ini:eaudm -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\Apsetup.ini:geaqp -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\Apsetup.ini:htrgr -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\Apsetup.ini:kugwf -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\Apsetup.ini:pkeix -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\Apsetup.ini:ucdov -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\Apsetup.ini:vjmxc -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\Apsetup.ini:yfhtw -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\Apsetup.ini:zgbht -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\atlab.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlae.exe -> Trojan.Agent.bi : Cleaned with backup
==========Deleted several hundred similar lines==========
C:\WINDOWS\desktop.ini:gltrs -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\desktop.ini:houkn -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\desktop.ini:igtmf -> TrojanDownloader.Agent.bq : Cleaned

with backup
========deleted a couple of dozen lines similar to above===========
C:\WINDOWS\ieac32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ieae32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ieav32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ieax.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iebb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iebc.exe -> Trojan.Agent.bi : Cleaned with backup
========deleted several dozen "ie" lines like above=========
C:\WINDOWS\ImportClient.INI:fglin -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:iuykc -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:mhboy -> TrojanDownloader.Agent.bc :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:nfqfg -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:oaieg -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:qldfs -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:ubffu -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:ufagk -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:yeyje -> TrojanDownloader.Agent.bc :

Cleaned with backup
C:\WINDOWS\ImportClient.INI:zwheu -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\ipal.exe -> Trojan.Agent.bi : Cleaned with backup
====deleted lots of java lines===========
C:\WINDOWS\javazu.exe -> Trojan.Agent.bi : Cleaned with backup
=========and lots of mf lines
C:\WINDOWS\msai.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msaj.exe -> Trojan.Agent.bi : Cleaned with backup
==and lots of ms lines=========
C:\WINDOWS\netaa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netae.exe -> Trojan.Agent.bi : Cleaned with backup
==and lots of net lines=====
C:\WINDOWS\ntai.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntaj.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntao32.exe -> Trojan.Agent.bi : Cleaned with backup
======and lots of nt lines========
C:\WINDOWS\ODBC.INI:cxeuy -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBC.INI:derxt -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\ODBC.INI:dfcxt -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBC.INI:eokcd -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBC.INI:frvqw -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBC.INI:kvxhk -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBC.INI:pghgg -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBC.INI:vkztm -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBC.INI:vpblh -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBC.INI:xrnas -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\ODBC.INI:xwayt -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\ODBCINST.INI:bydpi -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:emwsn -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:gfhns -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:gxxef -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:nvjfm -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:ochwx -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:qcmbv -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:qsxue -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:rjpgk -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\ODBCINST.INI:xyogq -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\orun32.ini:dkepr -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\orun32.ini:frxka -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\orun32.ini:lrrmo -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\orun32.ini:qrtwn -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\orun32.ini:tbrlp -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\PhotoDeluxe.scr:ddwsm -> TrojanDownloader.Agent.bc :

Cleaned with backup
C:\WINDOWS\PhotoDeluxe.scr:gbdka -> TrojanDownloader.Agent.bc :

Cleaned with backup
C:\WINDOWS\PhotoDeluxe.scr:hqnna -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\PhotoDeluxe.scr:pgzkj -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\PhotoDeluxe.scr:pthjt -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\PhotoDeluxe.scr:tyrtt -> TrojanDownloader.Agent.bc :

Cleaned with backup
C:\WINDOWS\PhotoDeluxe.scr:ugtkn -> TrojanDownloader.Agent.bc :

Cleaned with backup
C:\WINDOWS\PhotoDeluxe.scr:vxbah -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\PhotoDeluxe.scr:ydcei -> TrojanDownloader.Agent.bq :

Cleaned with backup
C:\WINDOWS\pixworks.ini:bpyjt -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\pixworks.ini:buifa -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\pixworks.ini:qwkxj -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\pixworks.ini:septr -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\pixworks.ini:zaaqn -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\PM7ART:acivo -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\PM7ART:dcvzq -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\PM7ART:ilxpo -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\PM7ART:iuyvx -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\PM7ART:lemio -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\PM7ART:oekyo -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\PM7ART:ubchd -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\pp310032.ini:aljdz -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\pp310032.ini:cadvo -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\pp310032.ini:oqhxb -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\pp310032.ini:urgqj -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\pp310032.ini:uzhcu -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\pp310032.ini:yijws -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\pp310032.ini:zpkzp -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\pp310032.ini:zuqmk -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\sdkaf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkah.exe -> Trojan.Agent.bi : Cleaned with backup
=======and lots of sd lines ============
C:\WINDOWS\SIERRA.INI:aspzf -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:fbhqa -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:jzsyc -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:magsi -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:mwamj -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:nlhpi -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:odexo -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:qpibf -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:rnisn -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:tscek -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIERRA.INI:uyouh -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:avger -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:bzqdb -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:dpuxu -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:hcdis -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:ltgbn -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:mgnii -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:thymy -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:weqbk -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:xdblm -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\SIGVERIF.TXT:xgilf -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\smscfg.ini:bapht -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\smscfg.ini:hhbft -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\smscfg.ini:mnend -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\smscfg.ini:njyyq -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\smscfg.ini:qrebw -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\smscfg.ini:tqbrz -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\smscfg.ini:wkodq -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\smscfg.ini:xwjrb -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\sysae32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysas32.exe -> Trojan.Agent.bi : Cleaned with backup
==and lots of sys lines========
C:\WINDOWS\system.ini:hpcrg -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\system.ini:qnszf -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\system.ini:seobo -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\system.ini:tadrz -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\system.ini:zfhik -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\system32:avaa.dll -> TrojanDownloader.Small.azk : Cleaned

with backup
C:\WINDOWS\system32\addaa.exe -> Trojan.Agent.bi : Cleaned with

backup
C:\WINDOWS\system32\addan32.exe -> Trojan.Agent.bi : Cleaned with

backup
C:\WINDOWS\system32\addap.exe -> Trojan.Agent.bi : Cleaned with

backup
C:\WINDOWS\system32\addau32.exe -> Trojan.Agent.bi : Cleaned with

backup
C:\WINDOWS\system32\addav32.dll -> TrojanDownloader.Agent.bc :

Cleaned with backup
C:\WINDOWS\system32\addav32.exe -> Trojan.Agent.bi : Cleaned with

backup
C:\WINDOWS\system32\addbj32.exe -> Trojan.Agent.bi : Cleaned with

backup
===and a maybe a couple of thouse system32 lines======
C:\WINDOWS\systf32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\systi.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\systr32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\systt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\systu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysuc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysuf32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysug32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysuj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysuk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysum.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysum32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysut32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysvb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysvd32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysvh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysvh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysvk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysvt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysvw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syswc32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syswh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syswk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syswn32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syswp32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysxa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysxg32.dll -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\sysxg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysxi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysxq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysxs32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysxu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysye.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysyf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysyh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysyr.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysys.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysyt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysyy.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syszb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syszb32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syszu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ULEAD32.INI:eazla -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\ULEAD32.INI:fwhcg -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\ULEAD32.INI:hfunl -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ULEAD32.INI:njeyq -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ULEAD32.INI:stywe -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ULEAD32.INI:uxgkq -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\ULEAD32.INI:vjqdp -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\ULEAD32.INI:xhqsj -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\ULEAD32.INI:xjgbq -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\vb.ini:inlgb -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\vb.ini:nrfsu -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\vb.ini:srgjd -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\vb.ini:tcdju -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\vb.ini:tljuy -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\vbaddin.ini:bnxro -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\vbaddin.ini:djpul -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\vbaddin.ini:jmcvy -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\vbaddin.ini:jvfaz -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\vbaddin.ini:oqnft -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\vbaddin.ini:zwhjs -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\visi.INI:djgqa -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\visi.INI:fywoj -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\visi.INI:nmuzq -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\visi.INI:oafjh -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\visi.INI:ojrrt -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\visi.INI:qrwjx -> TrojanDownloader.Agent.bc : Cleaned with

backup
C:\WINDOWS\visi.INI:srtho -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\visi.INI:wmtvx -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\visi.INI:xnjjt -> TrojanDownloader.Agent.bq : Cleaned with

backup
C:\WINDOWS\VPC32.INI:aeody -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\VPC32.INI:butxg -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\VPC32.INI:fbmpw -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\VPC32.INI:glwwp -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\VPC32.INI:iitkf -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\VPC32.INI:ikkum -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\VPC32.INI:pjtpw -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\VPC32.INI:rvwas -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\VPC32.INI:syxgh -> TrojanDownloader.Agent.bq : Cleaned

with backup
C:\WINDOWS\VPC32.INI:wdgsc -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\VPC32.INI:ydeasv -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\VTruck1.ini:ahowf -> TrojanDownloader.Agent.bc : Cleaned

with backup
C:\WINDOWS\VTruck1.ini:bttel -> TrojanDownloader.Agent.bc : Cleane

LDTate

Post #4July 17, 2005, 1:05 AM UTC

Looks a lot better

Lets run it again and see what we have now.

[*]Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Then, run ewido.

[*]Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!

[*]Click on scanner

[*]Click on Settings

Under "How to scan" all boxes should be selected
Under "Possibly unwanted software" all boxes should be selected
Under "What to scan" select scan every file
Click OK

[*]Click on Complete system scan

[*]Let the program scan the machine

[*]If ewido finds anything, it will pop up a notification. NOTE: We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, AOL, pcAnywhere and the game "Risk" have been flagged. In particular, watch for alerts that have the word "Heuristic" in them - if you recognize the file name as "friendly," these may actually be false positives) select "none" as the action. DO NOT check "Perform action with all infections." If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report.

[*]Click Save report

[*]Save the report to your desktop

[*]Exit ewido
Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

canoeman

Post #5July 17, 2005, 12:51 PM UTC

Thanks again LDTate.

When I ran EWIDO, I didn't remove 3 cookies and some Adobe stuff, though I was probably too conservative.

Here are the Hijackthis and EWIDO logs:

Thanks,
C-Man

Logfile of HijackThis v1.99.1
Scan saved at 8:40:07 AM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender8\vsserv.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Sparky\Application Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Sparky\Application Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dll
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender8\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [cnet] "C:\Program Files\Kontiki\bin\kontiki.exe" -s cnet -q
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\hcm.exe" -w
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1095374163859
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (YBIOCtrl Class) - http://us.dl1.yimg.com/download.yahoo.com/…bar/yiebio4.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SystemSuite Task Manager - Ontrack Data International - C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\System32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender8\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

EWIDO log —————————
———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 8:09:57 AM, 7/17/2005
+ Report-Checksum: 64A303EF

+ Scan result:

:mozilla.16:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Doubleclick : Ignored
:mozilla.20:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Mediaplex : Ignored
:mozilla.21:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Atdmt : Ignored
C:\WINDOWS\Adobereg.db:cxrwe -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\Adobereg.db:dokaf -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\Adobereg.db:gkqwh -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\Adobereg.db:jnpes -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\Adobereg.db:kdmxo -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\Adobereg.db:pnxuu -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\Adobereg.db:vrkfv -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\Adobereg.db:vshsy -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\Adobereg.db:zxtpp -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\001231_.tmp:aools -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\001231_.tmp:gsiie -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\001231_.tmp:huwnc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\001231_.tmp:nzkcs -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\001231_.tmp:opsct -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\001231_.tmp:qnmnl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\001231_.tmp:rmyos -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\001231_.tmp:ugwwb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\001231_.tmp:uidwc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\001231_.tmp:uixmz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\001231_.tmp:ulhid -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\001231_.tmp:wbiju -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\003713_.tmp:aksku -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\003713_.tmp:bdxxo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\003713_.tmp:bwjss -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\003713_.tmp:jjlsge -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\003713_.tmp:mtqhw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\003713_.tmp:psyoj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\003713_.tmp:srclx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\003713_.tmp:yvvyu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AM_D6.PRF:enlrv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\AM_D6.PRF:hyiwp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\AM_D6.PRF:kruzk -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\AM_D6.PRF:ljqah -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AM_D6.PRF:roaul -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AM_D6.PRF:yrcjc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AM_D6.PRF:zvrbj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:fmltz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:ktjqh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:lgjdh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:lsfbh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:mwjdr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:pwhxv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:rulba -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:sewpz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:teelv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:ybnmp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:yyxyu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Blue Lace 16.bmp:zbxrd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\bootstat.dat:boxgi -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\bootstat.dat:dsneu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\bootstat.dat:iavij -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\bootstat.dat:iwbls -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\bootstat.dat:mawbr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\bootstat.dat:ouggm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\bootstat.dat:qnfmp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\bootstat.dat:vdtju -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\bootstat.dat:wmtrs -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\bootstat.dat:xizhx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\bootstat.dat:zvspi -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\clock.avi:agaeq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\clock.avi:jdxsq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\clock.avi:kydbs -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\clock.avi:pieua -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\clock.avi:uosxo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\clock.avi:ysnqu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Coffee Bean.bmp:hvjqp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Coffee Bean.bmp:ietnq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Coffee Bean.bmp:jhkls -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Coffee Bean.bmp:kheaq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Coffee Bean.bmp:mvkpu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Coffee Bean.bmp:prjmo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Coffee Bean.bmp:szmpl -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Coffee Bean.bmp:vgawb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\euroconv.inf:fotcg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\euroconv.inf:gjsts -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\euroconv.inf:nrzvw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\euroconv.inf:ueixr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\euroconv.inf:ulrto -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\explorer.scf:bmldm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\explorer.scf:drdpg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:hmbze -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:jabmx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:jahmlq -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\explorer.scf:lyxuk -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:ouwlg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:rexvn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:uxmhn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\explorer.scf:xrvmi -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:xsvzg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:yjlup -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:aysly -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:dsmoj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:hybxy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:jwkxg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:lnfrp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:rvhyt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:xecfc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Gone Fishing.bmp:bzkoz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Gone Fishing.bmp:dkonm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Gone Fishing.bmp:eaciy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Gone Fishing.bmp:hgerb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Gone Fishing.bmp:vnuuc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Gone Fishing.bmp:zldyz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:bbarf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:bbarfb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:eoupw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:ffldd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:jikpa -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:jiqry -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:kkfkb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:ktoft -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:kziwd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:rysgk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:sakdt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:sgtws -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:vnwzv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:wesuf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:clhso -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:cmgqw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:fldzj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\jautoexp.dat:haoyr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\jautoexp.dat:ipfpm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\jautoexp.dat:jqoaw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:kaniu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:lzvdu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:pcntv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:qnanl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\jautoexp.dat:sihbq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:uxwqd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jautoexp.dat:wiati -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mozver.dat:luutp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mozver.dat:nmgbv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\mozver.dat:nxizu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\mozver.dat:qrlez -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\mozver.dat:ymuur -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\nsreg.dat:amitn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\nsreg.dat:baxef -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nsreg.dat:dggok -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nsreg.dat:dixey -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nsreg.dat:kmujg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nsreg.dat:njlcf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nsreg.dat:qahjd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\nsreg.dat:tcwpq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nsreg.dat:tcymw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nsreg.dat:uohwb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\orun32.isu:bwuby -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32.isu:frboc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\orun32.isu:jeccg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32.isu:jyvfn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32.isu:ongpt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\PowerReg.dat:bqvws -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PowerReg.dat:cdohq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PowerReg.dat:eyubm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\PowerReg.dat:fcsfd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\PowerReg.dat:gnnvq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PowerReg.dat:jatce -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PowerReg.dat:jnuha -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PowerReg.dat:xaasp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PowerReg.dat:ycrtr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\PowerReg.dat:yvmjt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Prairie Wind.bmp:dytdm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Prairie Wind.bmp:exgmu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Prairie Wind.bmp:ptqqo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Prairie Wind.bmp:stnmx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Prairie Wind.bmp:ufnnc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Prairie Wind.bmp:zcsbv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc2s.bmp:fhevj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc2s.bmp:iknzd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc2s.bmp:oefgq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc2s.bmp:rzaqu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc2s.bmp:vlhtl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc2s.bmp:vudye -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc2s.bmp:zmszg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc3.bmp:esulq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc3.bmp:ofzli -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:alkyy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:aqocr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:edtzg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:jatnb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:lvloc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:mqbup -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:onryu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:onvqd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:rquya -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:tobot -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:txwpf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:zgvjl -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc3s.bmp:zqrpy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4.bmp:ajyvw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4.bmp:caoqf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4.bmp:iaibh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4.bmp:pdcqy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc4.bmp:snahk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc4.bmp:wfptk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:aeuln -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:enaaz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:hafuj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:ifqlr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:ihocj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:kvzar -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:qddqa -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:ruvha -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:xtkmi -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:xzjop -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ps-rc4s.bmp:zrkpx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\pssoft.bmp:bbupp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\pssoft.bmp:eniky -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\pssoft.bmp:feewv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\pssoft.bmp:kvbfh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\qnsab.dat:dsoge -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\qnsab.dat:pwnsb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\qnsab.dat:rilvq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Duck Bathroom.dat:khlbu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Duck Bathroom.dat:kqzmo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Duck Bathroom.dat:leigx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Duck Bathroom.dat:urpgl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Duck Bathroom.dat:ylhls -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Duck Disco.dat:eirwk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Duck Disco.dat:ogevb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Duck Disco.dat:rogxo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Duck Disco.dat:tfbhd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\rcbod.dat:hpsvy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\rcbod.dat:ikcvc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\rcbod.dat:mypsu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\rcbod.dat:rirtl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:fsirt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:lgyej -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:lpmxs -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:otzrb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:tybpu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:uxpqc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:xmbet -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:fvcra -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:klonm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:mwizz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:nrcxc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:qzedg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:tbgak -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:vejrv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:xkmqb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:yidjv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:yoszf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\River Sumida.bmp:euleu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\River Sumida.bmp:fepqy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\River Sumida.bmp:lmzxg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\River Sumida.bmp:ttppt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\River Sumida.bmp:wutqx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\River Sumida.bmp:ziioy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Santa Fe Stucco.bmp:oocbc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Santa Fe Stucco.bmp:qwlaf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Santa Fe Stucco.bmp:rzdqg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Santa Fe Stucco.bmp:yadsb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Santa Fe Stucco.bmp:zbqul -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SBPCI.bmp:ckudh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SBPCI.bmp:dokti -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SBPCI.bmp:lcpes -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SBPCI.bmp:owedj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SBPCI.bmp:upzln -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SBPCI.ico:fyaiy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SBPCI.ico:hbkxr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SBPCI.ico:jfvrb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SBPCI.ico:pttcp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SBPCI.ico:sqdou -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SBPCI.ico:wrqio -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SBPCI.ico:xdpim -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SBPCI.ico:zungi -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:dexap -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:ghvdf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:gmdcm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:hclvl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:jjnsf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:jrzct -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:kbfwg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:lqaou -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:qqnuz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:qwtxv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:qxtqx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:tpwlm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setupapi.log.0.old:wdspg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:bxbnc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:bxwqr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:eraei -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:hwjiw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:itmux -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:jahwf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:kfmfp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:mktic -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:rjivw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:rooua -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:sewoh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:tvlzj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Soap Bubbles.bmp:ukqkb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Thumbs.db:ckrhu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Thumbs.db:hmrwm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Thumbs.db:ifmei -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Thumbs.db:mmyqx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Thumbs.db:wkmkv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Thumbs.db:xiybf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Thumbs.db:ylzcb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:aeqxb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:biiyh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:bklos -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:eulxw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:fnfhm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:gcliv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:koidl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:mzegy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:plmhq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:spmss -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:vgxym -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:vktet -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:wletz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:wwwsf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Ubtrv.ns:ytuur -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt.bmp:aihet -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt.bmp:fbjcg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt.bmp:haels -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt.bmp:hoplj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt.bmp:muewh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt.bmp:sihnv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt.bmp:svupq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt.bmp:viogg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt.bmp:zbmsg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt256.bmp:dwttn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt256.bmp:hhtww -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt256.bmp:hvvwm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt256.bmp:iwvtn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt256.bmp:jqbxv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt256.bmp:ktcsb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt256.bmp:vcdtv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\winnt256.bmp:vpaef -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt256.bmp:vtcdr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winnt256.bmp:xhhql -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\WMSysPr9.prx:ahofe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\WMSysPr9.prx:fbswh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\WMSysPr9.prx:hdjnc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\WMSysPr9.prx:ioppd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\WMSysPr9.prx:lugwe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\WMSysPr9.prx:rrdfv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\WMSysPr9.prx:vbtlt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\WMSysPrx.prx:jnezf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\WMSysPrx.prx:ljxuv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\WMSysPrx.prx:sporo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\WMSysPrx.prx:sqkix -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\WMSysPrx.prx:tmkal -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\WMSysPrx.prx:tnsra -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\WMSysPrx.prx:tpggh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\WMSysPrx.prx:unoge -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Zapotec.bmp:aquqd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Zapotec.bmp:bkljy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Zapotec.bmp:bygcb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Zapotec.bmp:eyrkj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Zapotec.bmp:lucah -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Zapotec.bmp:qpiqz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Zapotec.bmp:xzbxj -> TrojanDownloader.Agent.bc : Cleaned with backup
F:\System Volume Information\_restore{1349831D-D460-4D4B-992E-9AEC037AAFB3}\RP1120\A0063515.exe -> Heuristic.Win32.Dialer : Cleaned with backup
F:\System Volume Information\_restore{1349831D-D460-4D4B-992E-9AEC037AAFB3}\RP1120\A0063516.bat -> Backdoor.AcidShiver : Cleaned with backup

::Report End

LDTate

Post #6July 17, 2005, 12:59 PM UTC

Getting better, but we are still getting way too many fixes with the scan.
Should be able to get it down just cookies.

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

canoeman

Post #7July 17, 2005, 4:02 PM UTC

LDTate-

Boy, that was a quick response! Thanks.

Executed EWIDO and removed everything, rebooted and here is the EWIDO log and the new Hijackthis log.

Thanks much.
C-Man

Hijackthis—–

Logfile of HijackThis v1.99.1
Scan saved at 11:47:47 AM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Real\RealOne Player\RealPlay.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Softwin\BitDefender8\vsserv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Sparky\Application Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Sparky\Application Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dll
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender8\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [cnet] "C:\Program Files\Kontiki\bin\kontiki.exe" -s cnet -q
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\hcm.exe" -w
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1095374163859
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (YBIOCtrl Class) - http://us.dl1.yimg.com/download.yahoo.com/…bar/yiebio4.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SystemSuite Task Manager - Ontrack Data International - C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\System32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender8\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

EWIDO log-

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 11:41:47 AM, 7/17/2005
+ Report-Checksum: CBA92D27

+ Scan result:

:mozilla.14:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Linkbuddies : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies-1.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Linkbuddies : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Sparky\Application Data\Mozilla\Firefox\Profiles\default.78a\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
C:\WINDOWS\Adobereg.db:cxrwe -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Adobereg.db:dokaf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Adobereg.db:gkqwh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Adobereg.db:jnpes -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Adobereg.db:kdmxo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Adobereg.db:pnxuu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Adobereg.db:vrkfv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Adobereg.db:vshsy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Adobereg.db:zxtpp -> TrojanDownloader.Agent.bc : Cleaned with backup

::Report End

LDTate

Post #8July 17, 2005, 4:55 PM UTC

Look real good

Lets try this and see what we can cleanup.

To use it:

Download CCleaner from http://www.ccleaner.com/ and install.
Open CCleaner.
Place a check by everything in the Applications tab.
Place a check by Internet Explorer, Windows explorer, and System in the Windows tab.
Hit the button that says Run CCleaner
Reboot to remove index.dat files.

Notes:
1.Uncheck "Cookies" under "Internet Explorer".

2.if user is running Firefox: ,then click on the "Applications" tab and uncheck "Cookies" under "Firefox".

3.Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.

canoeman

Post #9July 17, 2005, 11:20 PM UTC

Thanks again. I ran CCleaner again, rebooted, and ran Hijackthis. Log pasted below. I ran Spybot and it was clean - formerly it found and could not clean Trek Blue. It looks like the nasty stuff is gone.

I can open MS Works applications now, which I couldn't earlier in this process, but IE still does not work. I tried downloading from MS, but when I attempt to install it says it detects a newer version already on the system.

EWIDO and Bitdefender both decided to start on reboot, and I've gone into Services to stop that. I'm using ZoneAlarm and Norton A/V. There is no longer an icon on the Taskbar for Norton, but the rtvscan process is running.

I also can't access Gmail. When I go to their website I get the error
"The file /mail/?view=page+name=js&ver=ac3b53ae970e1fe can not be found."

Thanks for your help.
C-Man

Logfile of HijackThis v1.99.1
Scan saved at 7:12:33 PM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Sparky\Application Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Sparky\Application Data\Mozilla\Profiles\default\zn5bgubs.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dll
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender8\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [cnet] "C:\Program Files\Kontiki\bin\kontiki.exe" -s cnet -q
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\hcm.exe" -w
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1095374163859
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (YBIOCtrl Class) - http://us.dl1.yimg.com/download.yahoo.com/…bar/yiebio4.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SystemSuite Task Manager - Ontrack Data International - C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\System32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender8\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

LDTate

Post #10July 17, 2005, 11:25 PM UTC

Lets see if this will fix IE.
If you download and double click on this small app, it will restore all the default search fuctions for IE.

http://www.spywareinfo.com/downloads/tools/IEFIX.reg

canoeman

Post #11July 17, 2005, 11:53 PM UTC

Thanks again LDTate. IE is working now, I'm not sure if the registry change was it or not. When I have attempted to execute IE, I would get an error that iexplore.exe could not be found and the system would try to search for it. Previously I was killing the search, I guess foolishly thinking that it was looking in the right place, and if it wasn't there it wasn't on the system. After changing the registry and getting that error again, I let it search,and it found it. I could get to gmail through IE, so that must be a problem with Firefox which I upgraded this morning because of its recent security problems. Yeah, I hesitated to make any changes to the system while you were helping me with others, but having just gotten hit with an IE vulnerability, I didn't want to get hit through Firefox. So I guess it's time for me to hit the Paypal button. You're great, I appreciate it very much. C-Man

LDTate

Post #12July 17, 2005, 11:56 PM UTC

Good Job

Log looks good

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK

If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

canoeman

Post #13July 18, 2005, 1:56 AM UTC

Mission accomplished. I particularly like the addition of SpywareBlaster and SpywareGuard to my system. Looks like some of the stuff that I clean regularly with Adaware should get blocked by them. Previously when I invoked Windows Explorer, the disk would churn and it took 15-20 seconds to fire up. Now it pops up quickly. That's a great unexpected benefit from this.

Again, many thanks for all the help. C-Man

LDTate

Post #14July 18, 2005, 1:57 AM UTC

Great job

You're more then welcome. Glad we were able to help Peace be with you

LDTate

Post #15July 21, 2005, 12:11 AM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

about:blank - Trek Blue infection

✨ Ask AI

Ask AI