Spyware / Malware / Virus Removal

I'm sure I did something wrong...

36 min read

Looking for the outcome? Ask AI

daparker

Post #16August 19, 2005, 4:14 PM UTC

Ok, we will need to find the hidden items to remove this. Please download SilentRunners from here (version 37). Right-click the link and choose save as. Save it to the desktop and then double-click on it. If you get any kind of warning message about scripts, please choose to allow the script to run. When the scan is finished, a message will pop up and a logfile will have been created on the desktop. Please post the entire contents of this logfile for me to see. When the script is done running, you will receive a popup informing you as such. Please wait for the script to run completely.

mrsteeler

Post #17August 20, 2005, 1:37 AM UTC

"Silent Runners.vbs", revision RED (R28) (Echo output), launched at: 21:32 Operating System: Windows XP SP2 Startup items buried in registry: ——————————— HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "PopUpStopperFreeEdition" = ""C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"" ["Panicware, Inc."] "AIM" = "C:\PROGRA~1\AIM\aim.exe -cnetwait.odl" ["America Online, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "SystemTray" = "SysTray.Exe" [MS] "Lexmark X6100 Series" = ""C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"" ["Lexmark International, Inc."] "IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"] "HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"] "SunJavaUpdateSched" = "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [null data] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."] "CaAvTray" = ""f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"" ["Computer Associates International, Inc."] "CAVRID" = ""f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"" ["Computer Associates International, Inc."] "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."] "qqjedll" = "C:\WINDOWS\qqjedll.exe" ["UpdateMonitor"] "xdfxenc" = "C:\WINDOWS\xdfxenc.exe" ["System Service"] HKLM\Software\Microsoft\Active Setup\Installed Components\ ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "Windows Media Player" \StubPath = "C:\WINDOWS\inf\unregmp2.exe /ShowWMP" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "PostBootReminder" = "{7849596a-48ea-486e-8937-a2a3009f31a9}" -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "CDBurn" = "{fbeb8a05-beee-4442-804e-409d6c4515e9}" -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "WebCheck" = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINDOWS\System32\webcheck.dll" [MS] "SysTray" = "{35CEC8A3-2BE6-11D2-8773-92E220524153}" -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINDOWS\System32\stobject.dll" [MS] Startup items in "me" & "All Users" startup folders: —————————————————– C:\Documents and Settings\All Users\Start Menu\Programs\Startup "Acrobat Assistant" -> shortcut to: "C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe" ["Adobe Systems Inc."] "Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] Enabled Scheduled Tasks: ———————— "Tune-up Application Start" -> launches: "walign" [file not found] "Uninstall Expiration Reminder" -> launches: "C:\WINDOWS\System32\OOBE\oobebaln.exe /sys /u /n:1" [MS] "RUTASK" -> launches: "C:\WINDOWS\ru.exe" [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): —————————————————————— Application Layer Gateway Service, ALG, "C:\WINDOWS\System32\alg.exe" [MS] Automatic Updates, wuauserv, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\wuauserv.dll" [MS]} CAISafe, CAISafe, "f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe" ["Computer Associates International, Inc."] COM+ Event System, EventSystem, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\es.dll" [MS]} Computer Browser, Browser, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\browser.dll" [MS]} Cryptographic Services, CryptSvc, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\cryptsvc.dll" [MS]} DCOM Server Process Launcher, DcomLaunch, "C:\WINDOWS\system32\svchost -k DcomLaunch" {"C:\WINDOWS\system32\rpcss.dll" [MS]} DHCP Client, Dhcp, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\dhcpcsvc.dll" [MS]} Distributed Link Tracking Client, TrkWks, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\trkwks.dll" [MS]} DNS Client, Dnscache, "C:\WINDOWS\System32\svchost.exe -k NetworkService" {"C:\WINDOWS\System32\dnsrslvr.dll" [MS]} Error Reporting Service, ERSvc, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\ersvc.dll" [MS]} Event Log, Eventlog, "C:\WINDOWS\system32\services.exe" [MS] Fast User Switching Compatibility, FastUserSwitchingCompatibility, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\shsvcs.dll" [MS]} Help and Support, helpsvc, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll" [MS]} iPod Service, iPodService, "C:\Program Files\iPod\bin\iPodService.exe" ["Apple Computer, Inc."] IPSEC Services, PolicyAgent, "C:\WINDOWS\System32\lsass.exe" [MS] LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."] Logical Disk Manager, dmserver, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\dmserver.dll" ["Microsoft Corp."]} Network Connections, Netman, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\netman.dll" [MS]} Network Location Awareness (NLA), Nla, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\mswsock.dll" [MS]} Plug and Play, PlugPlay, "C:\WINDOWS\system32\services.exe" [MS] Print Spooler, Spooler, "C:\WINDOWS\system32\spoolsv.exe" [MS] Protected Storage, ProtectedStorage, "C:\WINDOWS\system32\lsass.exe" [MS] Remote Access Connection Manager, RasMan, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\rasmans.dll" [MS]} Remote Procedure Call (RPC), RpcSs, "C:\WINDOWS\system32\svchost -k rpcss" {"C:\WINDOWS\system32\rpcss.dll" [MS]} Remote Registry, RemoteRegistry, "C:\WINDOWS\system32\svchost.exe -k LocalService" {"C:\WINDOWS\system32\regsvc.dll" [MS]} Secondary Logon, seclogon, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\seclogon.dll" [MS]} Security Accounts Manager, SamSs, "C:\WINDOWS\system32\lsass.exe" [MS] Security Center, wscsvc, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\wscsvc.dll" [MS]} Server, lanmanserver, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\srvsvc.dll" [MS]} Shell Hardware Detection, ShellHWDetection, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\shsvcs.dll" [MS]} SSDP Discovery Service, SSDPSRV, "C:\WINDOWS\System32\svchost.exe -k LocalService" {"C:\WINDOWS\System32\ssdpsrv.dll" [MS]} System Event Notification, SENS, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\sens.dll" [MS]} System Restore Service, srservice, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\srsvc.dll" [MS]} Task Scheduler, Schedule, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\schedsvc.dll" [MS]} TCP/IP NetBIOS Helper, LmHosts, "C:\WINDOWS\System32\svchost.exe -k LocalService" {"C:\WINDOWS\System32\lmhsvc.dll" [MS]} Telephony, TapiSrv, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\tapisrv.dll" [MS]} Terminal Services, TermService, "C:\WINDOWS\System32\svchost -k DComLaunch" {"C:\WINDOWS\System32\termsrv.dll" [MS]} Themes, Themes, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\shsvcs.dll" [MS]} VET Message Service, VETMSGNT, "f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe" ["Computer Associates International, Inc."] WebClient, WebClient, "C:\WINDOWS\System32\svchost.exe -k LocalService" {"C:\WINDOWS\System32\webclnt.dll" [MS]} Windows Audio, AudioSrv, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\audiosrv.dll" [MS]} Windows Firewall/Internet Connection Sharing (ICS), SharedAccess, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\ipnathlp.dll" [MS]} Windows Image Acquisition (WIA), stisvc, "C:\WINDOWS\System32\svchost.exe -k imgsvc" {"C:\WINDOWS\system32\wiaservc.dll" [MS]} Windows Management Instrumentation, winmgmt, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\wbem\WMIsvc.dll" [MS]} Windows Time, W32Time, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\w32time.dll" [MS]} Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS] Windows VisFx Components, Windows VisFx Components, "C:\WINDOWS\zxknsvc.exe" [null data] Wireless Zero Configuration, WZCSVC, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\wzcsvc.dll" [MS]} Workstation, lanmanworkstation, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\wkssvc.dll" [MS]} THANKS!!!!!

mrsteeler

Post #18August 20, 2005, 1:43 AM UTC

It looks like I ran 2 seperate Silent Runners

"Silent Runners.vbs", revision 40, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
———————————

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"PopUpStopperFreeEdition" = ""C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"" ["Panicware, Inc."]
"AIM" = "C:\PROGRA~1\AIM\aim.exe -cnetwait.odl" ["America Online, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SystemTray" = "SysTray.Exe" [MS]
"Lexmark X6100 Series" = ""C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"" ["Lexmark International, Inc."]
"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"SunJavaUpdateSched" = "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [null data]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."]
"CaAvTray" = ""f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"" ["Computer Associates International, Inc."]
"CAVRID" = ""f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"" ["Computer Associates International, Inc."]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"qqjedll" = "C:\WINDOWS\qqjedll.exe" ["UpdateMonitor"]
"xdfxenc" = "C:\WINDOWS\xdfxenc.exe" ["System Service"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{5b4dae26-b807-11d0-9815-00c04fd91972}" = "Menu Band"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS]
"{8278F931-2A3E-11d2-838F-00C04FD918D0}" = "Tracking Shell Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS]
"{E13EF4E4-D2F2-11d0-9816-00C04FD91972}" = "Menu Site"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS]
"{ECD4FC4F-521C-11D0-B792-00A0C90312E1}" = "Menu Desk Bar"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS]
"{D82BE2B0-5764-11D0-A96E-00C04FD705A2}" = "IShellFolderBand"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS]
"{0E5CBF21-D15F-11d0-8301-00AA005B4383}" = "&Links"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS]
"{7487cd30-f71a-11d0-9ea7-00805f714772}" = "Thumbnail Image"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "F:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
"{32A9D769-5B55-4a25-9A62-86B5683FE50A}" = "NikonView Drop Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Nikon\NkView6\NkvDropExt.dll" ["Nikon Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{1CE2AA40-1317-11D3-9922-00104B0AD431}" = "CA_AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\avshlext.dll" ["Computer Associates International, Inc."]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "F:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
CA_AntiVirus\(Default) = "{1CE2AA40-1317-11D3-9922-00104B0AD431}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\avshlext.dll" ["Computer Associates International, Inc."]
qxgggtsy\(Default) = "{4355f857-05ea-4657-852f-cbdb792b44fb}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nsrrr.dll" [file not found]
Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
CA_AntiVirus\(Default) = "{1CE2AA40-1317-11D3-9922-00104B0AD431}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\avshlext.dll" ["Computer Associates International, Inc."]

Group Policies [Description] {enabled Group Policy setting}:
————————————————————

HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore\
HIJACK WARNING! "DisableConfig"=dword:00000001
[disables options on Control Panel|System|System Restore (tab)]
{Computer Configuration|Administrative Templates|System|System Restore|
Turn off Configuration}

Active Desktop and Wallpaper:
—————————–

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\me\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp"

Startup items in "me" & "All Users" startup folders:
—————————————————-

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Acrobat Assistant" -> shortcut to: "C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe" ["Adobe Systems Inc."]
"Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

Enabled Scheduled Tasks:
————————

"Tune-up Application Start" -> launches: "walign" [file not found]
"Uninstall Expiration Reminder" -> launches: "C:\WINDOWS\System32\OOBE\oobebaln.exe /sys /u /n:1" [MS]
"RUTASK" -> launches: "C:\WINDOWS\ru.exe" [file not found]

Winsock2 Service Provider DLLs:
——————————-

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\VetRedir.dll ["Computer Associates International, Inc."], 01 - 03, 15
%SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 14
%SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08

Toolbars, Explorer Bars, Extensions:
————————————

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "Yahoo! Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll" ["Yahoo! Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "Yahoo! Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll" ["Yahoo! Inc."]

Explorer Bars

HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ = "&Yahoo! Messenger" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll" ["Yahoo! Inc."]

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ = "&Yahoo! Messenger" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll" ["Yahoo! Inc."]

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Research"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKCU\Software\Microsoft\Internet Explorer\Extensions\
{BC820660-6BB9-11D9-878A-0011AE97F2D7}\
"ButtonText" = "ComcastHSI"
"Exec" = "http://www.comcast.net/" [file not found]

{BC820661-6BB9-11D9-878A-0011AE97F2D7}\
"ButtonText" = "Help"
"Exec" = "http://online.comcast.net/help/" [file not found]

{BC820662-6BB9-11D9-878A-0011AE97F2D7}\
"ButtonText" = "Support"
"Exec" = "http://www.comcastsupport.com/" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\msjava.dll" [MS]

{4528BBE0-4E08-11D5-AD55-00010333D0AD}\
"ButtonText" = "Messenger"
"MenuText" = "Yahoo! Messenger"
"CLSIDExtension" = "{4C171D40-8277-11D5-AD55-00010333D0AD}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll" ["Yahoo! Inc."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\
"ButtonText" = "AIM"
"Exec" = "C:\PROGRA~1\AIM\aim.exe" ["America Online, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Running Services (Display Name, Service Name, Path {Service DLL}):
——————————————————————

CAISafe, CAISafe, "f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe" ["Computer Associates International, Inc."]
iPod Service, iPodService, "C:\Program Files\iPod\bin\iPodService.exe" ["Apple Computer, Inc."]
LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."]
VET Message Service, VETMSGNT, "f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe" ["Computer Associates International, Inc."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]
Windows VisFx Components, Windows VisFx Components, "C:\WINDOWS\zxknsvc.exe" [null data]

———-
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 196 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 122 seconds.
———- (total run time: 517 seconds)

daparker

Post #19August 20, 2005, 2:21 AM UTC

Ok, let's try safe mode. Please reboot your computer in Safe Mode by doing the following:

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear
Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see this site.

Please run HijackThis and click "Scan." Place checks next to the following entries:
O4 - HKLM\..\Run: [qqjedll] C:\WINDOWS\qqjedll.exe
O4 - HKLM\..\Run: [xdfxenc] C:\WINDOWS\xdfxenc.exe

Close all browser and other windows except for HijackThis, and click "Fix Checked" to have HijackThis fix the entries you checked.

Delete the following files:
C:\WINDOWS\qqjedll.exe
C:\WINDOWS\xdfxenc.exe

Reboot your computer into normal mode and post a new HJT log.

mrsteeler

Post #20August 20, 2005, 3:25 AM UTC

Hello. I did this originally under the ME user ID and then I tried it under Administrator as well. Looks like it's still there… THANKS FOR YOUR PERSERVERANCE I KNOW YOU CAN DO IT.

Logfile of HijackThis v1.99.1
Scan saved at 11:21:14 PM, on 8/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
F:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
F:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\PROGRA~1\AIM\aim.exe
C:\WINDOWS\System32\svchost.exe
f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\zxknsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\me\My Documents\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CaAvTray] "f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [qqjedll] C:\WINDOWS\qqjedll.exe
O4 - HKLM\..\Run: [xdfxenc] C:\WINDOWS\xdfxenc.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {BC820660-6BB9-11D9-878A-0011AE97F2D7} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Help - {BC820661-6BB9-11D9-878A-0011AE97F2D7} - http://online.comcast.net/help/ (file missing) (HKCU)
O9 - Extra button: Support - {BC820662-6BB9-11D9-878A-0011AE97F2D7} - http://www.comcastsupport.com/ (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {037790A6-1576-11D6-903D-00105AABADD3} (Seagull Web-to-Host Control Module v3) - https://bz1.matson.com/bluezone/sglw2hcm.ocx
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1108957571408
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://inges.webex.com/client/v_mywebex/webex/ieatgpc.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS\zxknsvc.exe

daparker

Post #21August 20, 2005, 4:16 AM UTC

You did this in Safe Mode, right?

mrsteeler

Post #22August 20, 2005, 11:28 AM UTC

Yes, I print put your instructions and cross each step off in sequence to make sure I don't miss anything. Anything that referenced Safe mode has been done in safe mode. Thanks

daparker

Post #23August 22, 2005, 4:19 AM UTC

Ok, let's see if we can do this another way. Please download the trial version of Ewido Security Suite here. Install it, and update the definitions to the newest files. Run the scan in safe mode and allow it fix what it finds. Please post the log for me to review. Please also post a new HJT log.

mrsteeler

Post #24August 24, 2005, 4:23 AM UTC

Hijack This Log:
Logfile of HijackThis v1.99.1
Scan saved at 12:17:53 AM, on 8/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
F:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\System32\svchost.exe
f:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\me\My Documents\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft

Internet Explorer provided by Comcast
N3 - Netscape 7: user_pref("browser.startup.homepage",

"http://home.netscape.com/"); (C:\Documents and Settings\me\Application

Data\Mozilla\Profiles\default\qdh95hym.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine",

"http://www.google.com/"); (C:\Documents and Settings\me\Application

Data\Mozilla\Profiles\default\qdh95hym.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100

Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CaAvTray] "f:\Program Files\CA\eTrust EZ Armor\eTrust EZ

Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "f:\Program Files\CA\eTrust EZ Armor\eTrust EZ

Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [PopUpStopperFreeEdition]

"C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat

5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program

Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program

Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program

Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} -

C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program

Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -

C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {BC820660-6BB9-11D9-878A-0011AE97F2D7} -

http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Help - {BC820661-6BB9-11D9-878A-0011AE97F2D7} -

http://online.comcast.net/help/ (file missing) (HKCU)
O9 - Extra button: Support - {BC820662-6BB9-11D9-878A-0011AE97F2D7} -

http://www.comcastsupport.com/ (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF: {037790A6-1576-11D6-903D-00105AABADD3} (Seagull Web-to-Host

Control Module v3) - https://bz1.matson.com/bluezone/sglw2hcm.ocx
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) -

http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://v5.windowsupdate.microsoft.com/v5co…/x86/client/wuw

eb_site.cab?1108957571408
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility

Class) -

http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

http://a840.g.akamai.net/7/840/537/2004061…icro.com/housec

all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -

http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) -

http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -

http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment

1.4.1_02) -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -

http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) -

https://inges.webex.com/client/v_mywebex/webex/ieatgpc.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) -

http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - f:\Program

Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program

Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program

Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -

C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates

International, Inc. - f:\Program Files\CA\eTrust EZ Armor\eTrust EZ

Antivirus\VetMsg.exe
O23 - Service: Windows VisFx Components - Unknown owner -

C:\WINDOWS\zxknsvc.exe (file missing)
***********************************************************
EWIDO Log:
———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 11:01:57 PM, 8/23/2005
+ Report-Checksum: 6AC43479

+ Scan result:

HKLM\SOFTWARE\Classes\AppID\BookedSpace.DLL -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\AppID\{0DC5CD7C-F653-4417-AA43-D457BE3A9622} -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\BookedSpace.Extension -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\BookedSpace.Extension\CLSID -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\BookedSpace.Extension\CurVer -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8DA5457F-A8AA-4CCF-A842-70E6FD274094} -> Spyware.HuntBar : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B5AB638F-D76C-415B-A8F2-F3CEAC502212} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{E004800A-73C6-4587-B855-98D0CE0C16B1} -> Spyware.BrowserAid : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{05080E6B-A88A-4CFD-8C3D-9B2557670B6E} -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B548B7D8-3D03-4AED-A6A1-4251FAD00C10} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B99A727F-0782-4A71-BCC2-6E1E66414904} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Spyware.WebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{0DC5CD7C-F653-4417-AA43-D457BE3A9622} -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\lnin -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindowsUpdate -> Spyware.BrowserAid : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindowsUpdate\Active -> Spyware.BrowserAid : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DisplayUtility -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-1343024091-1563985344-1708537768-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> Spyware.BookedSpace : Cleaned with backup
HKU\S-1-5-21-1343024091-1563985344-1708537768-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{016235BE-59D4-4CEB-ADD5-E2378282A1D9} -> Spyware.AproposMedia : Cleaned with backup
HKU\S-1-5-21-1343024091-1563985344-1708537768-1003\Software\Mvu -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-1343024091-1563985344-1708537768-1003\Software\{12EE7A5E-0674-42f9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043060.dll -> Spyware.Delfin : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043061.ocx -> Spyware.Delfin : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043066.exe -> Spyware.Apropos : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043069.exe -> Spyware.DelphinMediaViewer : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043106.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043120.EXE -> Adware.Saha : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043121.dll -> Adware.SAHA : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043122.exe -> Adware.SAHA : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043131.exe -> TrojanDownloader.PurityScan.y : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043137.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043139.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043140.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043286.exe -> Spyware.Delfin : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043307.dll -> TrojanDownloader.Apropo.ah : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043457.exe -> TrojanDropper.Agent.lu : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043466.exe -> TrojanDownloader.PurityScan.y : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043468.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043484.dll -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043706.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043736.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043738.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043743.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043765.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043775.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043781.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043793.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043799.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043804.EXE -> TrojanDropper.Small.qn : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043810.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0043839.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044027.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044113.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044124.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044148.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044158.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044193.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044236.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044256.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044268.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044291.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044364.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044370.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044373.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044383.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044386.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044416.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044417.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044423.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044433.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044467.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044468.exe -> Spyware.CashBack : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044469.exe -> Spyware.CashBack : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044471.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044473.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044497.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044619.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044626.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044665.exe -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044669.dll -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0044670.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045041.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045065.dll -> Spyware.WebSearch : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045069.exe -> Spyware.WebSearch : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045072.dll -> TrojanDownloader.Apropo.ah : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045094.dll -> Spyware.WebSearch : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045095.exe -> Spyware.WebSearch : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045404.EXE -> TrojanDownloader.Small.aal : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045405.exe -> TrojanDownloader.Apropo.ae : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP252\A0045452.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046311.DLL -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046314.dll -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046315.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046316.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046317.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046318.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046319.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046320.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046321.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046322.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046323.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046324.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046325.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046326.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046327.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046328.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046329.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046330.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046331.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046332.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046333.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046334.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046335.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046336.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046337.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046338.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046339.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046340.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046341.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046342.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046343.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046344.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046345.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046346.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046347.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046348.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046349.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046350.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046351.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046352.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046353.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP259\A0046354.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP263\A0047535.dll -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP263\A0047537.dll -> Spyware.SafeSurfing : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP263\A0047540.DLL -> TrojanDownloader.Braidupdate.d : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP263\A0047541.EXE -> Spyware.SafeSurfing : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP263\A0047542.EXE -> TrojanDownloader.VB.hj : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP263\A0047543.EXE -> TrojanDownloader.VB.hj : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP263\A0047555.dll -> Spyware.CASClient : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP263\A0047556.exe -> Spyware.CASClient : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0047673.exe -> TrojanDownloader.VB.hj : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0047674.exe -> TrojanDropper.Agent.mu : Cleaned with backup
C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0047676.exe -> TrojanDownloader.VB.hj : Cleaned with backup
C:\WINDOWS\SYSTEM32\nѕlookup.exe -> Spyware.PurityScan : Cleaned with backup
C:\WINDOWS\SYSTEM32\wirxycfg.exe -> TrojanDownloader.Agent.ro : Cleaned with backup
C:\WINDOWS\SYSTEM32\nsn10B.dll -> Spyware.HotSearchBar : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\me@statcounter[1].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\me@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\me@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\me@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\me@edge.ru4[2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\[removed][1].txt -> Spyware.Cookie.Shopathomeselect : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\[removed][2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\me@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\me@paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
C:\WINDOWS\TEMP\Cookies\[removed][2].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\WINDOWS\eehkkntj.exe -> Spyware.BookedSpace : Cleaned with backup
C:\WINDOWS\icont.exe -> Spyware.AdURL : Cleaned with backup
C:\WINDOWS\visfxun.exe -> TrojanDownloader.VB.kd : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq79.tmp -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq92.tmp -> Spyware.WebSearch : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq95.tmp -> Spyware.WebSearch : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq96.tmp\TBPS.exe -> Spyware.WebSearch : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq96.tmp\nzqlihv.wzg -> Spyware.WebSearch : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq96.tmp\toolbar.dll -> Spyware.WebSearch : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC8.tmp -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCA.tmp -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCB.tmp -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCC.tmp -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCD.tmp -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD4.tmp -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD5.tmp -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD6.tmp -> Spyware.Cookie.Hypertracker : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD7.tmp -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD8.tmp -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDC.tmp -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\20050731230151.zip/Program Files/common files/uninstall information/RemoveDisplayUtility.exe -> Spyware.Delfin : Error during cleaning
C:\Program Files\adra\tesi.exe -> TrojanDownloader.PurityScan.y : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@tribalfusion[2].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed]-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@nasdaq.122.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@hypertracker[1].txt -> Spyware.Cookie.Hypertracker : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@247realmedia[2].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\me@qksrv[2].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\nsh_107.exe -> Spyware.Downloadware : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\uninstall.exe -> Spyware.EliteBar : Cleaned with backup
C:\Documents and Settings\me\Local Settings\Temp\temp.fr9E97 -> Spyware.AproposMedia : Cleaned with backup
C:\Documents and Settings\me\My Documents\HijackThis\backups\backup-20050818-181702-897.dll -> Spyware.BookedSpace : Cleaned with backup
C:\Documents and Settings\me\My Documents\HijackThis\backups\backup-20050818-181702-167.dll -> Spyware.SafeSurfing : Cleaned with backup
C:\Documents and Settings\me\My Documents\ist_remove.exe -> TrojanDownloader.IstBar.jt : Cleaned with backup
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wjvdmod.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wqadmoe.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/pulmon.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kpdnec.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/krdsp.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wgafbdrv.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/madtclog.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/jft.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/muminst.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/sthedsvc.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kddhept.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/axistres.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/mbobjs.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/mxswch.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wistream.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/ikput.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/ksdsl.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/mzorcl32.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wcvcore.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/nzobjapi.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/IXGOG60R.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/ismon.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/ihetcplc.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/Cupaig32.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wivdmod.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/amistres.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/nsprovau.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/igircl.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/mqrating.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/sdhedsvc.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wYhnetbs.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/cnnsole.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kmdgae.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/CfssBMSEncode.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/CassUIDMSMsgbox.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kwdno.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/swrmfilt.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kvdmaori.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/aci2dvag.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/pEpnetsh.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\me\Cookies\me@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed]-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@112.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@adorigin[2].txt -> Spyware.Cookie.Adorigin : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@qksrv[1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@valuead[2].txt -> Spyware.Cookie.Valuead : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][3].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][3].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@cnn.122.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\me\Cookies\me@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Realtracker : Cleaned with backup
:mozilla.6:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.8:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.12:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.13:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.14:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.18:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.Hypertracker : Cleaned with backup
:mozilla.26:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.38:C:\Documents and Settings\me\Application Data\Mozilla\Profiles\default\qdh95hym.slt\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\49U7KXMB\!update-2144[1].0000 -> Spyware.Look2Me : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\49U7KXMB\!update-2244[1].0000 -> TrojanDownloader.PurityScan.y : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\XZ943GF4\!update-2154[1].0000 -> Spyware.Look2Me : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\XZ943GF4\!update-2104[1].0000 -> Spyware.Look2Me : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\XZ943GF4\!update-2114[1].0000 -> Spyware.Look2Me : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\K36SOPZP\!update-2164[1].0000 -> Spyware.PurityScan : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\K36SOPZP\!update-2134[1].0000 -> Spyware.PurityScan : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7QY48BTP\!update-2214[1].0000 -> TrojanDownloader.PurityScan.y : Cleaned with backup

::Report End

THANKS !

daparker

Post #25August 24, 2005, 5:07 AM UTC

Download: CCleaner (freeware)
http://www.majorgeeks.com/download4191.html
Once installed, run CCleaner click the Windows
Select the following:
[external image: Posted Image]
Next: click Options click the Settings tab
Uncheck: "Only delete files older than 48 hrs.", click Ok
Then click Run Cleaner (bottom right) then Exit.

Reboot your computer, then run another Ewido scan and post its log.

mrsteeler

Post #26August 25, 2005, 4:46 PM UTC

——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 5:58:01 AM, 8/25/2005 + Report-Checksum: A277FCE6 + Scan result: C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048685.exe -> Spyware.PurityScan : Cleaned with backup C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048686.exe -> TrojanDownloader.Agent.ro : Cleaned with backup C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048687.dll -> Spyware.HotSearchBar : Cleaned with backup C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048688.exe -> Spyware.BookedSpace : Cleaned with backup C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048689.exe -> Spyware.AdURL : Cleaned with backup C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048690.exe -> TrojanDownloader.VB.kd : Cleaned with backup C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048691.exe -> Spyware.WebSearch : Cleaned with backup C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048692.dll -> Spyware.WebSearch : Cleaned with backup C:\System Volume Information\_restore{579058AC-E8E0-4B1E-ADE8-9470BEA9FB8E}\RP267\A0048693.exe -> TrojanDownloader.PurityScan.y : Cleaned with backup C:\Program Files\Yahoo!\YPSR\Quarantine\20050731230151.zip/Program Files/common files/uninstall information/RemoveDisplayUtility.exe -> Spyware.Delfin : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wjvdmod.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wqadmoe.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/pulmon.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kpdnec.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/krdsp.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wgafbdrv.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/madtclog.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/jft.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/muminst.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/sthedsvc.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kddhept.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/axistres.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/mbobjs.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/mxswch.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wistream.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/ikput.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/ksdsl.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/mzorcl32.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wcvcore.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/nzobjapi.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/IXGOG60R.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/ismon.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/ihetcplc.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/Cupaig32.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wivdmod.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/amistres.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/nsprovau.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/igircl.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/mqrating.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/sdhedsvc.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/wYhnetbs.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/cnnsole.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kmdgae.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/CfssBMSEncode.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/CassUIDMSMsgbox.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kwdno.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/swrmfilt.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/kvdmaori.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/aci2dvag.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Desktop\l2mfix\backup.zip/pEpnetsh.dll -> Spyware.Look2Me : Cleaned with backup C:\Documents and Settings\me\Cookies\me@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Falkag : Cleaned with backup C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Falkag : Cleaned with backup C:\Documents and Settings\me\Cookies\me@burstnet[1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup C:\Documents and Settings\me\Cookies\me@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup C:\Documents and Settings\me\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\me\Cookies\me@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup C:\Documents and Settings\me\Cookies\[removed][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup C:\Documents and Settings\me\Cookies\me@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup C:\Documents and Settings\me\Cookies\me@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\me\Cookies\me@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup C:\Documents and Settings\me\Cookies\me@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup C:\Documents and Settings\me\Cookies\me@edge.ru4[2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup ::Report End Thanks!!!!

daparker

Post #27August 26, 2005, 5:11 AM UTC

Ok, just items in the restore points (we will clear those out later), quarantine and the L2M backup. How are things running?

mrsteeler

Post #28August 26, 2005, 12:10 PM UTC

Much better! Just regular pop ups that I know are from the websites I visit that are easily handled by IE pop up blocker and pop up stopper. No app crashes lately!

daparker

Post #29August 29, 2005, 3:48 PM UTC

Sorry for the late response. I was out Friday moving to a new home and my Internet has not been hooked up at my new house. You should be able to hook this system back up to the network now as it is pretty clean. We do need to clear out your restore points. To do this, we need to disable system restore, then re-enable it. That will clear out your restore points. If you right-click on the "My Computer" icon, then choose, the "System Restore" tab, you should be able to disable/re-enable things. Let me know how that goes.

mrsteeler

Post #30August 29, 2005, 3:59 PM UTC

I can access the system restore tab where before I couldn't, but the disable system restore by group check box is grayed out and it won't let me change settings or anything…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

I'm sure I did something wrong...

✨ Ask AI

Ask AI