Spyware / Malware / Virus Removal

PLease Help POPUP POPUP POPUP

13 min read

Looking for the outcome? Ask AI

Nakedpoolplayer Topic Starter

Post #1July 22, 2005, 1:20 PM UTC

Hello,

THis computer apprears to be infested with some really bad stuff. Please Help.

God Bless you.

Dave

Logfile of HijackThis v1.99.1
Scan saved at 9:20:24 AM, on 7/22/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\PSSVC.EXE
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.exe
c:\winnt\system32\cjapde.exe
C:\WINNT\System32\qttask.exe
C:\WINNT\loadqm.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\System32\RUNDLL32.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\WINNT\System32\drivecheck.exe
C:\WINNT\System32\w?aclt.exe
C:\Program Files\Cas\Client\casclient.exe
C:\WINNT\System32\drivecheck.exe
C:\Program Files\ulin\aama.exe
C:\WINNT\System32\taskmgr.exe
Z:\deco32.exe
C:\Program Files\Internet Explorer\iexplore.exe
\Ntexchange\Users\QUALITY\Anti-Spy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://216.17.111.216/porno/index.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.exactsearch.net/sidesearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =

http://NTEXCHANGE:80
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINNT\cfgmgr52.dll
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINNT\systb.dll
O2 - BHO: (no name) - {372134A0-DD6C-B4BB-63ED-810D84FEA6CD} - C:\WINNT\System32\yyhsfuu.dll
O2 - BHO: AuroraHandlerObj Class - {4AA870AC-8427-42a4-B92E-ECD956197489} -

C:\WINNT\AuroraHandler.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -

C:\WINNT\System32\nvms.dll
O2 - BHO: CBIAKAUAb2 Class - {B63B9EC0-2E9E-42AA-BFBA-DB7ADA25413F} -

C:\WINNT\System32\biakaua2.dll
O2 - BHO: (no name) - {BE056E4D-DD8F-E50F-D906-8FADAECC7593} - C:\WINNT\System32\gvcigge.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - c:\lotus\organize\iehelper.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} -

C:\WINNT\System32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [PsMgr] C:\Program Files\EveryZone\pcsafer\Psmgr.exe /update
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINNT\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [exp.exe] C:\WINNT\System32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINNT\System32\wintask.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBOUNCER\VirtualBouncer.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINNT\wupdt.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [zklebcf] c:\winnt\system32\cjapde.exe r
O4 - HKCU\..\Run: [Oare] C:\Program Files\ulin\aama.exe
O4 - HKCU\..\Run: [Dptrtdmb] C:\WINNT\System32\w?aclt.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [drivecheck] C:\WINNT\System32\drivecheck.exe
O9 - Extra button: Web Entry - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINNT\System32\Shdocvw.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {0C4A9D28-66B5-4A70-B915-B6AEA5112472} (Icon02 Control) -

http://216.17.111.216/icon02.cab
O16 - DPF: {1A6B786C-9062-4B2F-BD76-AD4653FF480E} (Club5678 Update Control) -

http://www.club5678.com/etc/activex/ClubCtrl.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://a224.g.akamai.net/7/224/52/20010620…meInstaller.exe
O16 - DPF: {42291FF4-803F-4C7D-94D4-56A9C98B8376} (InskwodAct Control) -

http://www.ulisesang.pe.kr/keyserver/f6mvft7h.cab
O16 - DPF: {4E452475-E8F6-4C26-9BA1-8105CB710199} (TvOnline Control) -

http://www.everyzone.com/pcsafer/pcsafer.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) -

http://cafeimg.hanmail.net/cab9/dmcc2.cab
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} -

http://download.weatherbug.com/minibug/tri…uginstaller.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {E7476A34-7790-4177-AE49-479CC08099B2} (WebEditor Control) -

http://www.club5678.com/etc/activex/WebEditor.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} -

http://winfixer.com/pages/scanner/WinFixer…nnerInstall.cab
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\Cas\Client\casmf.dll
O20 - AppInit_DLLs: Bq@
O20 - Winlogon Notify: IPConfTSP - C:\WINNT\system32\ctodm.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: AutoShutdown - Dell computer Corporation - C:\WINNT\System32\PSSVC.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. -

C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program

Files\NavNT\rtvscan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\Script Blocking\SBServ.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe

Micah_6:8

Post #2July 22, 2005, 9:34 PM UTC last edited July 22, 2005, 9:35 PM UTC

Step 1:

Click here to download Ewido security suite - it is a trial version of the program.

Install Ewido security suite
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
Launch Ewido, there should be an icon on your desktop double-click it.
The program will now go to the main screen

You will need to update Ewido to the latest definition files.

On the left hand side of the main screen click update
Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.

After the definitions have been updated, close Ewido.

Do NOT run a scan yet.

Please use the following link to download Nailfix.exe.

Nailfix.exe

Unzip it to the desktop but do NOT run it yet.

Reboot in "safe" mode.

Once in Safe Mode, please on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.

Now, run Ewido, then:

Click on scanner
Click on Complete System Scan and the scan will begin (do not open any folder's or open the windows control panel while the scan is in progress).
While the scan is in progress you will be prompted to clean files, click OK
When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report
Click Save report.
Save the report.txt file to your desktop.

Now close Ewido security suite.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Then click "Fix checked".

Reboot in normal mode and make a new Hijack This! log file.

If that "F2" line stays gone, continue with the other steps.

If the "F2" line returns, "copy/paste" a new Hijack This! log file, and the report.txt file from the Ewido scan, into this thread, and wait for my reply.

Step 2:

Download CWShredder.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Double-click on CWShredder.exe to run it.

Click "Fix ->" and click "OK" at the prompt.

CWShredder will scan and clean your system of CWS files.

Click "Next->" and then "Exit".

Reboot.

Step 3:

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.

Get Spybot - Search & Destroy from Spybot Search and Destroy
(This is the NEW Version 1.4)
Get AdAware SE Personal from Lavasoft
(This is the NEW Build 1.6)

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

Configure Adaware

Configure Spybot

Reboot after running each program.

Step 4:

Try this online virus scan:

Trend-Micro Housecall

Choose "fix" or "clean".

Let it remove any infections found.

Reboot and "copy/paste" a new Hijack This! log file, and the report.txt file from the Ewido scan, into this thread.

Nakedpoolplayer

Post #3July 28, 2005, 6:46 PM UTC

Hello My Friend,

The beast apprears to be firmly entrenched in my machine. LOL

Here is my Hijack log and the report txt. as requested if the F2 Nail.exe was still there.

Thanks for you help.

Logfile of HijackThis v1.99.1
Scan saved at 2:40:53 PM, on 7/28/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\PSSVC.EXE
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\qttask.exe
C:\WINNT\loadqm.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\System32\drivecheck.exe
C:\Program Files\ulin\aama.exe
C:\WINNT\System32\w?aclt.exe
C:\Program Files\Cas\Client\casclient.exe
C:\WINNT\System32\drivecheck.exe
J:\QUALITY\Anti-Spy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://NTEXCHANGE:80
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINNT\dsr.dll
O2 - BHO: (no name) - {372134A0-DD6C-B4BB-63ED-810D84FEA6CD} - C:\WINNT\System32\yyhsfuu.dll
O2 - BHO: AuroraHandlerObj Class - {4AA870AC-8427-42a4-B92E-ECD956197489} - C:\WINNT\AuroraHandler.dll (file missing)
O2 - BHO: CBIAKAUAb2 Class - {B63B9EC0-2E9E-42AA-BFBA-DB7ADA25413F} - C:\WINNT\System32\biakaua2.dll
O2 - BHO: (no name) - {BE056E4D-DD8F-E50F-D906-8FADAECC7593} - C:\WINNT\System32\gvcigge.dll
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [PsMgr] C:\Program Files\EveryZone\pcsafer\Psmgr.exe /update
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINNT\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [exp.exe] C:\WINNT\System32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINNT\System32\wintask.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [Dinst] C:\WINNT\dinst.exe
O4 - HKLM\..\Run: [ansvnhb] c:\winnt\system32\zdwyfm.exe r
O4 - HKCU\..\Run: [Oare] C:\Program Files\ulin\aama.exe
O4 - HKCU\..\Run: [Dptrtdmb] C:\WINNT\System32\w?aclt.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [drivecheck] C:\WINNT\System32\drivecheck.exe
O9 - Extra button: Web Entry - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {0C4A9D28-66B5-4A70-B915-B6AEA5112472} (Icon02 Control) - http://216.17.111.216/icon02.cab
O16 - DPF: {1A6B786C-9062-4B2F-BD76-AD4653FF480E} (Club5678 Update Control) - http://www.club5678.com/etc/activex/ClubCtrl.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620…meInstaller.exe
O16 - DPF: {42291FF4-803F-4C7D-94D4-56A9C98B8376} (InskwodAct Control) - http://www.ulisesang.pe.kr/keyserver/f6mvft7h.cab
O16 - DPF: {4E452475-E8F6-4C26-9BA1-8105CB710199} (TvOnline Control) - http://www.everyzone.com/pcsafer/pcsafer.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/cab9/dmcc2.cab
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tri…uginstaller.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {E7476A34-7790-4177-AE49-479CC08099B2} (WebEditor Control) - http://www.club5678.com/etc/activex/WebEditor.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/pages/scanner/WinFixer…nnerInstall.cab
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\Cas\Client\casmf.dll
O20 - AppInit_DLLs: Bq@
O20 - Winlogon Notify: Applets - C:\WINNT\system32\guard.tmp
O23 - Service: AutoShutdown - Dell http://consumeralertsystem.com/cas/zx-hclick.php?hid=233' target='_blank'>computer Corporation - C:\WINNT\System32\PSSVC.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing)

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 2:34:47 PM, 7/28/2005
+ Report-Checksum: A5289E4C

+ Scan result:

HKLM\SOFTWARE\Bargains -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\ADP.UrlCatcher -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\ADP.UrlCatcher\CLSID -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\AppID\BookedSpace.DLL -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\AppID\{0DC5CD7C-F653-4417-AA43-D457BE3A9622} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\BookedSpace.Extension -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\BookedSpace.Extension\CLSID -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\BookedSpace.Extension\CurVer -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{417386C3-8D4A-4611-9B91-E57E89D603AC} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.URLBlaze : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CLSID -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CurVer -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CLSID -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CurVer -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CLSID -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CurVer -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CLSID -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CurVer -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{05080E6B-A88A-4CFD-8C3D-9B2557670B6E} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{10D7DB96-56DC-4617-8EAB-EC506ABE6C7E} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{6CDC3337-01F7-4A79-A4AF-0B19303CC0BE} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{795398D0-DC2F-4118-A69C-592273BA9C2B} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E1357} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E5678} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B288F21C-A144-4CA2-9B70-8AFA1FAE4B06} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED11357} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED15678} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.WurldMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\NLS.UrlCatcher -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\NLS.UrlCatcher\CLSID -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\PopOops2.PopOops -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\PopOops2.PopOops\Clsid -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\SWLAD1.SWLAD -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\SWLAD1.SWLAD\Clsid -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{0DC5CD7C-F653-4417-AA43-D457BE3A9622} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516B2C3} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516C2E3} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{D0C29A75-7146-4737-98EE-BC4D7CF44AF9} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{E0D3B292-A0B0-4640-975C-2F882E039F52} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CLSID -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CurVer -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\ClickSpring -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.PurityScan : Cleaned with backup
HKLM\SOFTWARE\eXactUtil -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE7C3CF0-4B15-11D1-ABED-709549C10000} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.URLBlaze : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BargainBuddy -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NaviSearch -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\NaviSearch -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.NaviSearch : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BetterInternet : Cleaned with backup
HKU\S-1-5-21-1168209255-138313077-925700815-1012\Software\VB and VBA Program Settings\VBouncer -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.VirtualBouncer : Cleaned with backup
HKU\S-1-5-21-1168209255-138313077-925700815-1012\Software\VB and VBA Program Settings\VBouncer\Settings -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.VirtualBouncer : Cleaned with backup
[596] VM_02910000 -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Error during cleaning
[644] C:\WINNT\system32\oqbc16gt.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
[728] c:\winnt\system32\ssfbjca.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Error during cleaning
C:\WINNT\SYSTEM32\JLEG2X32.DLL -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\WINNT\SYSTEM32\MLDTCLOG.DLL -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\WINNT\SYSTEM32\exentlog.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\WINNT\SYSTEM32\bsackbox.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\WINNT\SYSTEM32\AUNPS2.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Hijacker.Generic : Cleaned with backup
C:\WINNT\SYSTEM32\SWLAD2.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.VirtualBouncer : Cleaned with backup
C:\WINNT\SYSTEM32\wintask.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\WINNT\SYSTEM32\SWLAD1.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.VirtualBouncer : Cleaned with backup
C:\WINNT\SYSTEM32\PopOops2.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.VirtualBouncer : Cleaned with backup
C:\WINNT\SYSTEM32\PopOops.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.VirtualBouncer : Cleaned with backup
C:\WINNT\SYSTEM32\DrPMon.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\SYSTEM32\exdl.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\exul.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\javexulm.vxd -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\bbchk.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\msbe.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\nvms.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\exdl2.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\exdl1.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\exul1.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\WINNT\SYSTEM32\ctodm.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\WINNT\SYSTEM32\diiman32.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\WINNT\SYSTEM32\oqbc16gt.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\WINNT\SYSTEM32\zdwyfm.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\TEMP\nsh_114.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Downloadware : Cleaned with backup
C:\WINNT\TEMP\b.com -> TrojanDropper.Agent.pb : Cleaned with backup
C:\WINNT\TEMP\upd209.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\WINNT\TEMP\D1972\aurora.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\TEMP\D1444\aurora.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\TEMP\D2804\aurora.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\cfgmgr52.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BookedSpace : Cleaned with backup
C:\WINNT\whpkrkm.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\svcproc.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\Nail.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\AuroraHandler.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=51' target='_blank'>adware.BetterInternet : Cleaned with backup
C:\WINNT\dsr.exe -> Trojan.Imiserv.c : Cleaned with backup
C:\WINNT\tdtb.exe -> Trojan.Imiserv.c : Cleaned with backup
C:\WINNT\dsr.dll -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Hijacker.Generic : Cleaned with backup
C:\WINNT\ru.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.PurityScan : Cleaned with backup
C:\Temp\Installer.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Look2Me : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@2o7[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@bfast[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Bfast : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@doubleclick[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@ads.x10[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.X10 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@edge.ru4[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@atdmt[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@ads.x10[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.X10 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@dbbsrv[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Dbbsrv : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@advertising[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@edge.ru4[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@specificclick[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@questionmarket[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@revenue[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Revenue : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed]-sys[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@serving-sys[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@hitbox[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@statcounter[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Statcounter : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@trafficmp[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@tribalfusion[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@centrport[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@2o7[3].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@fastclick[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Paypopup : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitslink : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@burstnet[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@questionmarket[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@site.x10[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.X10 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@hitbox[3].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@serving-sys[3].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@statcounter[3].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Statcounter : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@mediaplex[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@paycounter[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Paycounter : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][3].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@casalemedia[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@trafficmp[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@edge.ru4[3].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@yieldmanager[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@revenue[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Revenue : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@clickagents[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Clickagents : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@advertising[3].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@paypopup[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Paypopup : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@2o7[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@targetnet[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Targetnet : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@valueclick[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@fastclick[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@bluestreak[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@adtech[2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Adtech : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@overture[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@abetterinternet[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][3].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\jimm@qksrv[1].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\jimm\COOKIES\[removed][2].txt -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.Cookie.Valuead : Cleaned with backup
C:\Program Files\BullsEye Network\bin\bargains.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\Program Files\BullsEye Network\bin\adv.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\Program Files\BullsEye Network\bin\adx.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\Program Files\NaviSearch\bin\nls.exe -> http://consumeralertsystem.com/cas/zx-hclick.php?hid=50' target='_blank'>spyware.BargainBuddy : Cleaned with backup
C:\Program Files\CasStub\casstub.exe -> TrojanDownloader.Agent.qg : Cleaned with backup

::Report End

Micah_6:8

Post #4July 28, 2005, 11:28 PM UTC

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe

O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINNT\dsr.dll

O2 - BHO: (no name) - {372134A0-DD6C-B4BB-63ED-810D84FEA6CD} - C:\WINNT\System32\yyhsfuu.dll

O2 - BHO: AuroraHandlerObj Class - {4AA870AC-8427-42a4-B92E-ECD956197489} - C:\WINNT\AuroraHandler.dll (file missing)

O2 - BHO: CBIAKAUAb2 Class - {B63B9EC0-2E9E-42AA-BFBA-DB7ADA25413F} - C:\WINNT\System32\biakaua2.dll

O2 - BHO: (no name) - {BE056E4D-DD8F-E50F-D906-8FADAECC7593} - C:\WINNT\System32\gvcigge.dll

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINNT\cfgmgr52.dll,DllRun

O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16

O4 - HKLM\..\Run: [exp.exe] C:\WINNT\System32\exp.exe

O4 - HKLM\..\Run: [WinTask driver] C:\WINNT\System32\wintask.exe

O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe

O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe

O4 - HKLM\..\Run: [Dinst] C:\WINNT\dinst.exe

O4 - HKLM\..\Run: [ansvnhb] c:\winnt\system32\zdwyfm.exe r

O4 - HKCU\..\Run: [Oare] C:\Program Files\ulin\aama.exe

O4 - HKCU\..\Run: [Dptrtdmb] C:\WINNT\System32\w?aclt.exe

O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620…meInstaller.exe

O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tri…uginstaller.cab

O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\Cas\Client\casmf.dll

O20 - AppInit_DLLs: Bq@

O20 - Winlogon Notify: Applets - C:\WINNT\system32\guard.tmp

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing)

Then click "Fix checked".

Now click on Config –> Misc Tools –> Delete a file on reboot

Enter this in the File name box:

C:\WINNT\Nail.exe

Click OK and let your system reboot.

When it reboots, reboot in "safe" mode.

Delete all of these noted file(s)/FOLDER(s) you can find:

aunps2.dll <— file

c:\program files\bullseye network <— FOLDER

c:\program files\cas <— FOLDER

c:\program files\navisearch <— FOLDER

c:\program files\ulin\aama.exe <— file

c:\winnt\cfgmgr52.dll <— file

c:\winnt\dinst.exe <— file

c:\winnt\dsr.dll <— file

c:\winnt\system32\biakaua2.dll <— file

c:\winnt\system32\exp.exe <— file

c:\winnt\system32\guard.tmp <— file

c:\winnt\system32\gvcigge.dll <— file

c:\winnt\system32\w?aclt.exe <— file
BE SURE THE FILE YOU DELETE MATCHES THIS NAME EXACTLY!!!

c:\winnt\system32\wintask.exe <— file

c:\winnt\system32\yyhsfuu.dll <— file

c:\winnt\system32\zdwyfm.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread.

Nakedpoolplayer

Post #5July 29, 2005, 3:11 PM UTC

Hello my Friend,

Looks like still in trouble. I won't turn off until I hear back from you.

Have a good weekend!

Logfile of HijackThis v1.99.1
Scan saved at 11:09:46 AM, on 7/29/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\PSSVC.EXE
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\qttask.exe
C:\WINNT\loadqm.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\etb\pokapoka62.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINNT\System32\clbcore.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\WINNT\System32\drivecheck.exe
C:\WINNT\System32\w?aclt.exe
C:\Program Files\ulin\aama.exe
C:\WINNT\System32\bwcdbc10.exe
C:\WINNT\System32\drivecheck.exe
C:\My Documents\Anti-Spy\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://NTEXCHANGE:80
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINNT\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINNT\System32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\System32\msbe.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [PsMgr] C:\Program Files\EveryZone\pcsafer\Psmgr.exe /update
O4 - HKLM\..\Run: [SystemService] C:\WINNT\etb\pokapoka62.exe
O4 - HKLM\..\Run: [System service62] C:\WINNT\etb\pokapoka62.exe
O4 - HKLM\..\Run: [hniiuc] C:\WINNT\System32\hniiuc.exe
O4 - HKLM\..\Run: [AutoLoaderAproposClient] "C:\WINNT\system32\cxtpls_loader.EXE" /HideUninstall /HideDir /PC= CP.AOP /ForSupportedBrowsers /ShowLegalNote=nonbranded
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [p4mX37l] clbcore.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKCU\..\Run: [Dptrtdmb] C:\WINNT\System32\w?aclt.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [drivecheck] C:\WINNT\System32\drivecheck.exe
O4 - HKCU\..\Run: [Y357RXJ7T] bwcdbc10.exe
O9 - Extra button: Web Entry - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {0C4A9D28-66B5-4A70-B915-B6AEA5112472} (Icon02 Control) - http://216.17.111.216/icon02.cab
O16 - DPF: {1A6B786C-9062-4B2F-BD76-AD4653FF480E} (Club5678 Update Control) - http://www.club5678.com/etc/activex/ClubCtrl.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620…meInstaller.exe
O16 - DPF: {42291FF4-803F-4C7D-94D4-56A9C98B8376} (InskwodAct Control) - http://www.ulisesang.pe.kr/keyserver/f6mvft7h.cab
O16 - DPF: {4E452475-E8F6-4C26-9BA1-8105CB710199} (TvOnline Control) - http://www.everyzone.com/pcsafer/pcsafer.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/cab9/dmcc2.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {E7476A34-7790-4177-AE49-479CC08099B2} (WebEditor Control) - http://www.club5678.com/etc/activex/WebEditor.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/pages/scanner/WinFixer…nnerInstall.cab
O20 - Winlogon Notify: CSCSettings - C:\WINNT\system32\guard.tmp
O23 - Service: AutoShutdown - Dell Computer Corporation - C:\WINNT\System32\PSSVC.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing)

Micah_6:8

Post #6July 29, 2005, 5:06 PM UTC

Copy the contents of the following quote box into Notepad.

cd c:\winnnt
dir > nail.exe

Save it to your desktop as kn.bat.

Boot in "safe" mode.

the kn.bat file on the desktop. A DOS window will briefly flash on the screen.

Reboot in normal mode.

An error will appear, but that's OK.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe

O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINNT\System32\nvms.dll

O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} -
C:\WINNT\System32\mscb.dll

O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\System32\msbe.dll

O4 - HKLM\..\Run: [SystemService] C:\WINNT\etb\pokapoka62.exe

O4 - HKLM\..\Run: [System service62] C:\WINNT\etb\pokapoka62.exe

O4 - HKLM\..\Run: [hniiuc] C:\WINNT\System32\hniiuc.exe

O4 - HKLM\..\Run: [AutoLoaderAproposClient] "C:\WINNT\system32\cxtpls_loader.EXE" /HideUninstall /HideDir /PC= CP.AOP /ForSupportedBrowsers /ShowLegalNote=nonbranded

O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain

O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C

O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"

O4 - HKLM\..\Run: [p4mX37l] clbcore.exe

O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe

O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe

O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe

O4 - HKCU\..\Run: [Dptrtdmb] C:\WINNT\System32\w?aclt.exe

O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"

O4 - HKCU\..\Run: [Y357RXJ7T] bwcdbc10.exe

O20 - Winlogon Notify: CSCSettings - C:\WINNT\system32\guard.tmp

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing)

Reboot in "safe" mode.

Delete all of these noted file(s)/FOLDER(s) you can find:

C:\WINNT\Nail.exe <— file

C:\WINNT\System32\nvms.dll <— file

C:\WINNT\System32\mscb.dll <— file

C:\WINNT\System32\msbe.dll <— file

C:\WINNT\etb <— FOLDER

C:\WINNT\System32\hniiuc.exe <— file

C:\WINNT\system32\cxtpls_loader.EXE <— file

stlb2.dll <— file

C:\Program Files\AutoUpdate <— FOLDER

clbcore.exe <— file

C:\Program Files\BullsEye Network <— FOLDER

C:\Program Files\NaviSearch <— FOLDER

C:\Program Files\CashBack <— FOLDER

C:\WINNT\System32\w?aclt.exe <— file
BE SURE THE FILE YOU DELETE MATCHES THIS NAME EXACTLY!!!

C:\Program Files\Cas <— FOLDER

bwcdbc10.exe <— file

C:\WINNT\system32\guard.tmp <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread.

Nakedpoolplayer

Post #7July 29, 2005, 7:18 PM UTC

Hi,

Still a problem

Logfile of HijackThis v1.99.1
Scan saved at 3:16:13 PM, on 7/29/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\PSSVC.EXE
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\qttask.exe
C:\WINNT\loadqm.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\System32\RUNDLL32.exe
C:\WINNT\System32\drivecheck.exe
C:\WINNT\System32\drivecheck.exe
C:\Program Files\ulin\aama.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\My Documents\Anti-Spy\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://NTEXCHANGE:80
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [PsMgr] C:\Program Files\EveryZone\pcsafer\Psmgr.exe /update
O4 - HKLM\..\Run: [System service62] C:\WINNT\etb\pokapoka62.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKCU\..\Run: [drivecheck] C:\WINNT\System32\drivecheck.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O9 - Extra button: Web Entry - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {0C4A9D28-66B5-4A70-B915-B6AEA5112472} (Icon02 Control) - http://216.17.111.216/icon02.cab
O16 - DPF: {1A6B786C-9062-4B2F-BD76-AD4653FF480E} (Club5678 Update Control) - http://www.club5678.com/etc/activex/ClubCtrl.cab
O16 - DPF: {42291FF4-803F-4C7D-94D4-56A9C98B8376} (InskwodAct Control) - http://www.ulisesang.pe.kr/keyserver/f6mvft7h.cab
O16 - DPF: {4E452475-E8F6-4C26-9BA1-8105CB710199} (TvOnline Control) - http://www.everyzone.com/pcsafer/pcsafer.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/cab9/dmcc2.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {E7476A34-7790-4177-AE49-479CC08099B2} (WebEditor Control) - http://www.club5678.com/etc/activex/WebEditor.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/pages/scanner/WinFixer…nnerInstall.cab
O20 - Winlogon Notify: ExtShellViews - C:\WINNT\system32\nitui1.dll
O23 - Service: AutoShutdown - Dell Computer Corporation - C:\WINNT\System32\PSSVC.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing)

Thanks,

Dave

Micah_6:8

Post #8July 29, 2005, 10:45 PM UTC

Yes, but ONE LESS problem at least.

Now that "nail.exe" is finally laid to rest, we can kill the "Look2Me" infection you most likely have.

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe

http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.

l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing .

This will scan your computer and it may appear nothing is happening, then, after a minute or 2, Notepad will open with a log. Copy/paste the contents of that log into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

Nakedpoolplayer

Post #9August 1, 2005, 3:34 PM UTC

L2MFIX find log 1.03 These are the registry keys present ******************************************************************* *************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] "Asynchronous"=dword:00000000 "DllName"="" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ExtShellViews] "Asynchronous"=dword:00000000 "DllName"="C:\\WINNT\\system32\\nitui1.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" Thanks for your help. Dave

Micah_6:8

Post #10August 1, 2005, 10:35 PM UTC last edited August 2, 2005, 1:57 AM UTC

Hmmm….

Not seeing what "Look2Me" normally does…

Let's just drive on for the time being.

Download CWShredder.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Double-click on CWShredder.exe to run it.

Click "Fix ->" and click "OK" at the prompt.

CWShredder will scan and clean your system of CWS files.

Click "Next->" and then "Exit".

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll

O4 - HKLM\..\Run: [System service62] C:\WINNT\etb\pokapoka62.exe

O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe

O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16

O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe

O20 - Winlogon Notify: ExtShellViews - C:\WINNT\system32\nitui1.dll

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing)

Then click "Fix checked".

Now, please go to:

Start –> Run

In the box type in services.msc then hit (or click OK)

In the Name column in the next screen look for:

System Startup Service (SvcProc)

it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINNT\svcproc.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

Close the services.msc window.

Reboot in "safe" mode.

Delete all of these noted file(s)/FOLDER(s) you can find:

c:\winnt\system32\aunps2.dll <— file

c:\program files\surfsidekick 3 <— FOLDER

c:\program files\ulin <— FOLDER

c:\winnt\etb <— FOLDER

c:\winnt\system32\nitui1.dll <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread.

Nakedpoolplayer

Post #11August 2, 2005, 1:33 PM UTC

Hello Again!

Here's todays log……

Many Thanks for helping me….. Dave

Logfile of HijackThis v1.99.1
Scan saved at 9:33:41 AM, on 8/2/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\PSSVC.EXE
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\qttask.exe
C:\WINNT\loadqm.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\System32\drivecheck.exe
C:\WINNT\System32\drivecheck.exe
C:\Program Files\ulin\aama.exe
C:\My Documents\Anti-Spy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://NTEXCHANGE:80
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [PsMgr] C:\Program Files\EveryZone\pcsafer\Psmgr.exe /update
O4 - HKCU\..\Run: [drivecheck] C:\WINNT\System32\drivecheck.exe
O9 - Extra button: Web Entry - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: {0C4A9D28-66B5-4A70-B915-B6AEA5112472} (Icon02 Control) - http://216.17.111.216/icon02.cab
O16 - DPF: {1A6B786C-9062-4B2F-BD76-AD4653FF480E} (Club5678 Update Control) - http://www.club5678.com/etc/activex/ClubCtrl.cab
O16 - DPF: {42291FF4-803F-4C7D-94D4-56A9C98B8376} (InskwodAct Control) - http://www.ulisesang.pe.kr/keyserver/f6mvft7h.cab
O16 - DPF: {4E452475-E8F6-4C26-9BA1-8105CB710199} (TvOnline Control) - http://www.everyzone.com/pcsafer/pcsafer.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/cab9/dmcc2.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {E7476A34-7790-4177-AE49-479CC08099B2} (WebEditor Control) - http://www.club5678.com/etc/activex/WebEditor.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/pages/scanner/WinFixer…nnerInstall.cab
O23 - Service: AutoShutdown - Dell Computer Corporation - C:\WINNT\System32\PSSVC.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe

Micah_6:8

Post #12August 2, 2005, 4:27 PM UTC

Looking good, Dave!!!!

Things should be "normal" for you now.

If you have no further problems, we'll call this hijack solved!!!

GOD bless you!!!

M68

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Micah_6:8

Post #13August 2, 2005, 9:09 PM UTC

Dave.. I overlooked something in the log:

C:\Program Files\ulin\aama.exe

Unless you know what that is, boot in safe mode & delete that folder:

C:\Program Files\ulin <– FOLDER

Reboot in normal mode & see if it stays gone.

As Maxwell Smart use to say, "Sorry about that, Chief."

Nakedpoolplayer

Post #14August 5, 2005, 7:49 PM UTC

Hello My Friend, Thanks for giving me the heads up on the ulin directory. I have no idea what its for but I sure don't want it. I have tried three times to remove during safe mode and every time I reboot it reappears. Does'nt seem to be effecting performance and doesn't seem to cause popups. What's my next move? Many Thanks, Dave

Micah_6:8

Post #15August 6, 2005, 12:43 AM UTC

Download Killbox from here:

Killbox.zip

Then unzip it.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Killbox and paste the next line into the "Full Path of File to Delete" text box.

C:\Program Files\ulin\aama.exe

In Killbox select "Delete on Reboot".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new log file into this thread.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

PLease Help POPUP POPUP POPUP

✨ Ask AI

Ask AI