This one is driving me crazy, I can't seem to shake this hijack.at dot Made email addy less subject to Spambots - Micah_6:8
Greetings and welcome to TomCoyote.org!
Click
here to download Ewido security suite - it is a trial version of the program.
Install Ewido security suite When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu". Launch Ewido, there should be an icon on your desktop double-click it. The program will now go to the main screen You will need to update Ewido to the latest definition files.
On the left hand side of the main screen click update Then click on Start Update The update will start and a progress bar will show the updates being installed. If you are having problems with the updater, you can use this
link to manually update Ewido.
After Ewido is updated:
Reboot in "safe" mode Run Ewido Click on scanner Click on Complete System Scan and the scan will begin (do not open any folders or open the windows control panel while the scan is in progress). While the scan is in progress you will be prompted to clean files, click OK When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections " then choose clean and click OK . Once the scan has completed, there will be a button located on the bottom of the screen named Save report Click Save report . Save the report.txt file to your desktop. Now close Ewido security suite.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "
Do a systen scan only ".
Then "check" the box to the left of these item(s):
Then click "
Fix checked ".
Reboot in
"safe" mode .
Find and delete:
C:\WINDOWS\System32\
paabla.exe <— file
Some malware files may be "hidden".
Be sure to
show hidden files when looking for these file(s) and/or folder(s).
Reboot in normal mode and "copy/paste" a new Hijack This! log file, and the
report.txt file from Ewido,
into this thread .
Fixed, atleast I think it is fixed.
No sign of it at all, and machine is really crisp now!
I could not find the paabla.exe once the scan/fix was finished.
I belive the scanner fixed it all together.
I was also worried because I was prompted and asked about what to do with some embedded files it found. With much hesitation and worry, I elected to delete all the the embedded archive files it asked me about. But, no worries, everything still works and my machine really rocks now!!
Thank you so much!
Logfile of HijackThis v1.99.1
Scan saved at 6:23:20 PM, on 7/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Cosmo Popup Blocker\CosmoPopupBlocker.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\THE BAT!\thebat.exe
C:\Program Files\HiJacker\HijackThis.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{10566A99-F21B-4C97-963B-B0C66C718F1A}: NameServer = 207.251.194.54 207.251.194.55
O17 - HKLM\System\CS1\Services\Tcpip\..\{10566A99-F21B-4C97-963B-B0C66C718F1A}: NameServer = 207.251.194.54 207.251.194.55
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
———————————————————
ewido security suite - Scan report
———————————————————
+ Created on: 5:56:55 PM, 7/18/2005
+ Report-Checksum: 4F75138C
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{38D2A281-0444-433C-9ED6-A2851795F32A} -> Spyware.CosmoPopup : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WhenUSave -> Spyware.SaveNow : Cleaned with backup
HKU\S-1-5-21-2000478354-1708537768-1060284298-1006\Software\WinUpdt -> Spyware.SecondThought : Cleaned with backup
HKU\S-1-5-21-2000478354-1708537768-1060284298-1006\Software\_rtneg2 -> Spyware.Begin2Search : Cleaned with backup
C:\WINDOWS\SYSTEM32\dist001.exe -> TrojanDownloader.VB.eu : Cleaned with backup
C:\WINDOWS\SYSTEM32\psoft1.exe -> Spyware.Pacer : Cleaned with backup
C:\WINDOWS\SYSTEM32\exp.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\WINDOWS\SYSTEM32\wintask.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\WINDOWS\SYSTEM32\nsf67.dll -> Spyware.Beginto : Cleaned with backup
C:\WINDOWS\SYSTEM32\main.exe -> TrojanDownloader.Agent.hw : Cleaned with backup
C:\WINDOWS\SYSTEM32\ps1.exe -> Spyware.Pacer : Cleaned with backup
C:\WINDOWS\SYSTEM32\20007.exe -> Spyware.Downloadware : Cleaned with backup
C:\WINDOWS\SYSTEM32\SIMONW32.exe -> Spyware.UrlSpy : Cleaned with backup
C:\WINDOWS\SYSTEM32\paabla.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\dcrmqrq.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\supdate.dll -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\WINDOWS\SYSTEM32\edoak.dll -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\datadx.dll -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\WINDOWS\SYSTEM32\conres.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\WINDOWS\SYSTEM32\installer_MARKETING18.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\WINDOWS\SYSTEM32\wrapperouter.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\WINDOWS\SYSTEM32\246765-ventura-hot.exe -> Spyware.HotSearchBar.e : Cleaned with backup
C:\WINDOWS\SYSTEM32\bs51-eginwl51-vb.exe -> Spyware.BookedSpace.e : Cleaned with backup
C:\WINDOWS\SYSTEM32\Cache\installer.exe -> TrojanDropper.Small.wc : Cleaned with backup
C:\WINDOWS\SYSTEM32\javex80.vxd/C:/WINDOWS/System32/nvms.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\WINDOWS\SYSTEM32\Cuvgbi.exe -> Spyware.DealHelper : Cleaned with backup
C:\WINDOWS\SYSTEM32\Fcheao.exe -> Trojan.Popmon.a : Cleaned with backup
C:\WINDOWS\SYSTEM32\Bzxqgr.exe -> Spyware.DealHelper : Cleaned with backup
C:\WINDOWS\SYSTEM32\thin-138-1-x-x.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\SYSTEM32\Umnoea.exe -> Trojan.Popmon.a : Cleaned with backup
C:\WINDOWS\SYSTEM32\HookPopup.dll -> Spyware.DealHelper : Cleaned with backup
C:\WINDOWS\SYSTEM32\GSMedia3.exe -> Trojan.VB.ux : Cleaned with backup
C:\WINDOWS\SYSTEM32\nsn63E.dll -> Spyware.HotBar : Cleaned with backup
C:\WINDOWS\SYSTEM32\pinstaller.exe -> Spyware.UrlSpy : Cleaned with backup
C:\WINDOWS\SYSTEM32\btnetw-ventura-hot_246765.exe -> Spyware.HotSearchBar : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\ycomp5_0_2_7.dll -> Spyware.Yahoo : Cleaned with backup
C:\WINDOWS\cfgmgr52.dll -> Spyware.BookedSpace : Cleaned with backup
C:\Program Files\HiJacker\backups\backup-20050513-202347-778.dll -> Spyware.Wintol : Cleaned with backup
C:\Program Files\HiJacker\backups\backup-20050513-205130-717.dll -> Spyware.BookedSpace : Cleaned with backup
C:\Program Files\HiJacker\backups\backup-20050514-180615-698-rdpi.exe -> TrojanDownloader.Qoologoc.i : Cleaned with backup
C:\Program Files\HiJacker\backups\backup-20050714-165514-259-rdpi.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\Program Files\HiJacker\backups\backup-20050716-153853-511-rdpi.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\Program Files\HiJacker\backups\backup-20050716-164408-659-rdpi.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\Program Files\HiJacker\backups\backup-20050716-172629-245-rdpi.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\Program Files\HiJacker\backups\backup-20050716-215414-374-rdpi.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@advertising[1].cab/extra@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\[removed]/[removed][1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@adviva[2].cab/extra@adviva[2].txt -> Spyware.Cookie.Adviva : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@atdmt[1].cab/extra@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@atdmt[2].cab/extra@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@atdmt[3].cab/extra@atdmt[3].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@bfast[2].cab/extra@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\[removed]/[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\[removed]/[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@hitbox[1].cab/extra@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\[removed]/[removed][1].txt -> Spyware.Cookie.Hitslink : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\[removed]/[removed][2].txt -> Spyware.Cookie.Hitslink : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@mediaplex[1].cab/extra@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\[removed]/[removed][1].txt -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@sextracker[1].cab/extra@sextracker[1].txt -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@targetnet[1].cab/extra@targetnet[1].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@valueclick[1].cab/extra@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@valueclick[2].cab/extra@valueclick[2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@advertising[2].cab/extra@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\[removed]/[removed][1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\extra@atdmt[2]0.cab/extra@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\[removed]/[removed][1].txt -> Spyware.Cookie.Hitslink : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\ipcclient.cab/ipcclient.dll -> Spyware.Aureate : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\bargains0.cab/bargains.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\bbchk0.cab/bbchk.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\exdl0.cab/exdl.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\exul.cab/exul.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\msbe.cab/msbe.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\nvms.cab/nvms.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\angelex.cab/angelex.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\exul1.cab/exul1.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\instsrv.cab/instsrv.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\msexreg.cab/msexreg.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\zeta.cab/zeta.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\javexulm.cab/javexulm.vxd -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\bin.cab/adv.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\bin.cab/adx.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WSup.cab/WSup.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WSup0.cab/WSup.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsA.cab/WToolsA.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsA0.cab/WToolsA.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsS.cab/WToolsS.exe -> TrojanDownloader.Wintool.f : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsS0.cab/WToolsS.exe -> TrojanDownloader.Wintool.f : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsB.cab/WToolsB.dll -> Spyware.Wintol : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsB0.cab/WToolsB.dll -> Spyware.Wintol : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WSup1.cab/WSup.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WSup2.cab/WSup.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsA1.cab/WToolsA.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsA2.cab/WToolsA.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsS1.cab/WToolsS.exe -> TrojanDownloader.Wintool.f : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsS2.cab/WToolsS.exe -> TrojanDownloader.Wintool.f : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\Search.cab/Search.vbs -> Spyware.Krepper : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WToolsB1.cab/WToolsB.dll -> Spyware.Wintol : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WinTools7.cab/WToolsA.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WinTools7.cab/WToolsB.dll -> Spyware.Wintol : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WinTools7.cab/WSup.exe -> Spyware.Wintools : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\WinTools7.cab/WToolsS.exe -> TrojanDownloader.Wintool.f : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\cxtplsloader0.cab/cxtpls_loader.exe -> TrojanDownloader.Apropo.ab : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\BundleOuter0.cab/BundleOuter.EXE -> Spyware.VirtualBouncer.j : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\SaveUninst.cab/SaveUninst.exe -> Adware.SaveNow : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\msipcsv.cab/msipcsv.exe -> Spyware.Aureate : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\Gator.cab/FSG\fsg.exe -> Adware.Gator : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\AdDestroyer.cab/AdDestroyer.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\PopOops.cab/PopOops.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\PopOops2.cab/PopOops2.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\SWLAD1.cab/SWLAD1.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\SWLAD2.cab/SWLAD2.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\cxtplsloader.cab/cxtpls_loader.exe -> TrojanDownloader.Apropo.ab : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\BundleOuter.cab/BundleOuter.EXE -> Spyware.VirtualBouncer.j : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\VBouncerInner.cab/VBouncerInner.EXE -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\VirtualBouncer.cab/VirtualBouncer.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\VirtualBouncer0.cab/VirtualBouncer.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\vbouncer.cab/AdDestroyerInner.EXE -> Spyware.VirtualBouncer.j : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\vbouncer.cab/VirtualBouncer.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\bbchk.cab/bbchk.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\exdl.cab/exdl.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\msbe0.cab/msbe.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\SpyFerret by OnlinePCfix\Archives\mscb.cab/mscb.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\FwBarTemp\searchbar.exe -> TrojanDownloader.VB.eu : Cleaned with backup
C:\A-2\boln.dll\boln.zip/boln.dll -> Spyware.Boln : Cleaned with backup
C:\GateScan\G-Scan3a.zip/GateScan3.exe -> Not-A-Virus.Flooder.MailSpam.Aenima.20 : Cleaned with backup
C:\GateScan\GateScan3.exe -> Not-A-Virus.Flooder.MailSpam.Aenima.20 : Cleaned with backup
C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe -> Spyware.Searcher : Cleaned with backup
C:\Documents and Settings\All Users\Application Data\msw\BMan.exe -> Spyware.MSWSearch : Cleaned with backup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rdpi.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\Documents and Settings\extra\Cookies\extra@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\extra\Cookies\[removed][1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\extra\Cookies\[removed][1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\extra\Cookies\extra@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP569\A0199911.exe -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP587\A0200443.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP587\A0200444.EXE -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP587\A0200445.EXE -> TrojanDownloader.Qoologic.q : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP587\A0200446.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP587\A0200447.DLL -> TrojanDownloader.Qoologic.q : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP589\A0200504.DLL -> TrojanDownloader.Qoologic.q : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP589\A0200511.EXE -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP589\A0200546.dll -> Spyware.Beginto : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP589\A0200554.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP589\A0200555.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP589\A0200556.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP523\A0194116.EXE -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP523\A0194125.exe -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP523\A0194150.exe -> TrojanDownloader.Agent.lg : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP523\A0194154.exe -> Spyware.Beginto.c : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP523\A0194161.EXE -> Trojan.Elzio : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP523\A0194162.EXE -> Trojan.Elzio : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP523\A0194163.EXE -> TrojanDownloader.Agent.mw : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP523\A0194164.EXE -> TrojanDownloader.Agent.lg : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP524\A0194208.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP524\A0194209.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP524\A0194210.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP524\A0194211.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP524\A0194212.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP526\A0194335.EXE -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP526\A0194361.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP526\A0194362.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP526\A0194363.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP526\A0194364.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP526\A0194419.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP526\A0194420.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP527\A0194551.dll -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP527\A0194553.exe -> TrojanDownloader.Adload.a : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP527\A0194556.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP527\A0194562.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP527\A0194563.dll -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP527\A0194564.exe -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP527\A0194567.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP527\A0194569.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP528\A0194631.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP528\A0194632.dll -> Spyware.Wintol : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP528\A0194633.exe -> Spyware.Wintools : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP528\A0194634.exe -> Spyware.Wintools : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP528\A0194635.exe -> TrojanDownloader.Wintool.f : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP529\A0194712.EXE -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP530\A0194738.exe -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP530\A0194763.exe -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195034.EXE -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195037.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195038.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195039.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195040.exe -> TrojanDownloader.Agent.hw : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195041.exe -> Spyware.BookedSpace.e : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195042.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195044.exe -> TrojanDownloader.VB.eu : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195046.exe -> TrojanDownloader.VB.eu : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195051.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195053.exe -> Spyware.UrlSpy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195054.exe -> Spyware.UrlSpy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195055.dll -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195059.exe -> Spyware.Wintools : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195070.exe -> Spyware.Wintools : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195071.exe -> TrojanDownloader.Wintool.f : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195072.exe -> Spyware.DealHelper : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195073.exe -> Spyware.BargainBuddy.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195074.exe -> Spyware.BookedSpace : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195087.exe -> Spyware.Wintools : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195103.exe -> TrojanDownloader.Qoologic.l : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195104.dll -> TrojanDownloader.Qoologic.l : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195112.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195113.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195138.exe -> TrojanDownloader.Small.aly : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195159.exe -> Spyware.Wintools : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195160.dll -> Spyware.Wintol : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195164.exe -> Spyware.Wintools : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195166.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195215.dll -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195216.exe -> TrojanDownloader.Qoologoc.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195217.exe -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195218.dll -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195228.dll -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195229.exe -> TrojanDownloader.Qoologoc.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195230.exe -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP534\A0195231.dll -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP539\A0195443.exe -> TrojanDropper.Small.wc : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP539\A0195444.EXE -> TrojanDownloader.Qoologoc.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP539\A0195445.EXE -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP539\A0195446.EXE -> TrojanDownloader.Qoologoc.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP539\A0195447.dll -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP540\A0195452.DLL -> TrojanDownloader.Qoologic.i : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP543\A0195701.dll -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP552\A0197656.cpl -> TrojanDropper.Small.wc : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP552\A0197657.EXE -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP552\A0197659.EXE -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP552\A0197665.dll -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP554\A0197958.dll -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP554\A0197959.DLL -> TrojanDownloader.Qoologic.q : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP556\A0198158.exe -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP557\A0198188.dll -> TrojanDownloader.Qoologic.q : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP557\A0198189.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP557\A0198190.exe -> TrojanDownloader.Qoologic.q : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP559\A0198332.exe -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198568.exe -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198601.EXE -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198612.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198613.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198614.vxd/C:/WINDOWS/System32/exdl.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198614.vxd/C:/WINDOWS/System32/exul.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198614.vxd/C:/WINDOWS/System32/javexulm.vxd -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198614.vxd/C:/WINDOWS/System32/bbchk.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198614.vxd/C:/WINDOWS/System32/msexreg.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP564\A0198614.vxd/C:/WINDOWS/System32/instsrv.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{13FCF0E6-2D39-460C-BE9A-E14D7C6AD5D7}\RP567\A0199821.exe -> Spyware.Pacer : Cleaned with backup
C:\Recycled\Q166352.exe -> TrojanDownloader.Agent.le : Cleaned with backup
C:\temporary\aun_0001.exe -> TrojanDownloader.Small.akz : Cleaned with backup
D:\Software\Misc Programs\Socks5Scan\Socks5Scan.zip/Socks5Scan.exe -> Not-A-Virus.HackTool.VB.ci : Cleaned with backup
D:\Software\Misc Programs\Socks5Scan\Socks5Scan.exe -> Not-A-Virus.HackTool.VB.ci : Cleaned with backup
::Report End
The log looks good!!!
Amazing how that carp** can creep into and hide on your machine…
And the "log", from Ewido??!!??
Looks more like a whole tree instead of a log…
I am pleased the forums here at TomCoyote.org have been of assistance.
GOD bless!!
M68
Items you may wish to consider to harden your defenses against future infections:"How did I get infected in the first place?" IE-Spyad Qualsys.com EVEN FROM PEOPLE YOU KNOW! UP-TO-DATE BEFORE BEFORE USING THEM
