This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

VIRUS PLEASE HELP

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Here is my logfile… please let me know what i should delete.
thanks
joanne


Logfile of HijackThis v1.99.1
Scan saved at 10:58:03 AM, on 8/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\5m8soump\5m8soump.exe
C:\Program Files\Safe Surfer\SafeSurfer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\5m8soump\18129976.exe
C:\Program Files\5m8soump\5m8soump.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe
C:\WINDOWS\etb\pokapoka63.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
C:\PROGRA~1\Netscape\Netscape\Netscp.exe
C:\Documents and Settings\Joanne\Desktop\hijak this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sympatico.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adshttp.com/servlet/ajrotator/12844…L?zone=enternet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [navapp] C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitefoi32.exe
O4 - HKLM\..\Run: [HELPER] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [5m8soump] C:\Program Files\5m8soump\5m8soump.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sympatico.ca
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbrowse…5.26/Hiwire.cab
O16 - DPF: {6BB594E2-6E4D-4CC9-98B0-931C323F9165} (DepHlp Control) - http://www.worldwinner.com/games/shared/dephlp.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://mirror.worldwinner.com/games/v41/sol/sol.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Please download miekiemoes' LQfix batch here:
http://www.downloads.subratam.org/LQfix.zip
Unzip it to the desktop but do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml


Once in Safe Mode, please run LQfix.bat. When finished, restart your computer in normal mode and please post a new HijackThis log.
new log…

Logfile of HijackThis v1.99.1
Scan saved at 1:34:35 PM, on 8/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\msiexec.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\5m8soump\5m8soump.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Joanne\Desktop\hijak this\HijackThis.exe
C:\Program Files\5m8soump\18129976.exe
C:\Program Files\5m8soump\5m8soump.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://iesearch.sympatico.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sympatico.ca
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://start.sympatico.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adshttp.com/servlet/ajrotator/12844…L?zone=enternet
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico Internet Service
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [navapp] C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [HELPER] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [5m8soump] C:\Program Files\5m8soump\5m8soump.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sympatico.ca
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbrowse…5.26/Hiwire.cab
O16 - DPF: {6BB594E2-6E4D-4CC9-98B0-931C323F9165} (DepHlp Control) - http://www.worldwinner.com/games/shared/dephlp.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://mirror.worldwinner.com/games/v41/sol/sol.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
let's continue on this thread… please ignore the "need help from siggyx" thread - that's me too… sorry for the confusion/extra work for you. joanne L2MFIX find log 1.03d These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Read BUILTIN\Power Users (ID-IO) ALLOW Read BUILTIN\Power Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SYMPA"="IEAK" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…" "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…" "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{efb97cb8-a4a4-4357-a261-002ffaed0267}"="CD Slideshow Powertoy" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D}"="SST" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{acb4a560-3606-11d3-aef4-00104bd0f92d}"="KodakShellExtension" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ iuengine.dll Thu May 26 2005 4:16:24a A…. 198,424 193.77 K wuaueng.dll Thu May 26 2005 4:16:30a A…. 1,343,768 1.28 M wuapi.dll Thu May 26 2005 4:16:30a A…. 465,176 454.27 K wups.dll Thu May 26 2005 4:16:30a A…. 41,240 40.27 K wucltui.dll Thu May 26 2005 4:16:30a A…. 127,256 124.27 K wuweb.dll Thu May 26 2005 4:16:30a A…. 173,536 169.47 K cdm.dll Thu May 26 2005 4:16:24a A…. 75,544 73.77 K wuaueng1.dll Thu May 26 2005 4:16:30a A…. 194,328 189.77 K wups2.dll Thu May 26 2005 4:16:30a A…. 18,200 17.77 K 9 items found: 9 files, 0 directories. Total of file sizes: 2,637,472 bytes 2.51 M Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Volume in drive C is DRIVE Volume Serial Number is 0930-15F8 Directory of C:\WINDOWS\System32 01/13/2016 07:30 AM 1,025 l34501.sys 03/19/2002 05:31 PM Microsoft 03/19/2002 02:52 PM dllcache 1 File(s) 1,025 bytes 2 Dir(s) 30,233,985,024 bytes free
Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
rebooted. green screen appeared which said "close using x or press any key to continue"
i pressed enter and it scanned then a few dialog lines appeared
no notepad with log
probably should have closed this window?
did new log file anyway…
jo

Logfile of HijackThis v1.99.1
Scan saved at 2:18:36 PM, on 8/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\5m8soump\5m8soump.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Documents and Settings\Joanne\Desktop\hijak this\HijackThis.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\5m8soump\18129976.exe
C:\Program Files\5m8soump\5m8soump.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://iesearch.sympatico.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sympatico.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adshttp.com/servlet/ajrotator/12844…L?zone=enternet
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico Internet Service
O2 - BHO: (no name) - {00000000-0000-4992-A818-5418B34FD10B} - C:\Program Files\5m8soump\5m8soump.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [navapp] C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [HELPER] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [5m8soump] C:\Program Files\5m8soump\5m8soump.exe
O4 - HKLM\..\Run: [second] C:\Documents and Settings\Joanne\Desktop\l2mfix\second.bat
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sympatico.ca
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbrowse…5.26/Hiwire.cab
O16 - DPF: {6BB594E2-6E4D-4CC9-98B0-931C323F9165} (DepHlp Control) - http://www.worldwinner.com/games/shared/dephlp.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://mirror.worldwinner.com/games/v41/sol/sol.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Install it, and update the definitions to the newest files.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
hijack this log…

Logfile of HijackThis v1.99.1
Scan saved at 5:47:38 PM, on 8/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\5m8soump\5m8soump.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\5m8soump\18129976.exe
C:\Program Files\5m8soump\5m8soump.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Documents and Settings\Joanne\Desktop\hijak this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://iesearch.sympatico.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sympatico.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adshttp.com/servlet/ajrotator/12844…L?zone=enternet
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico Internet Service
O2 - BHO: (no name) - {00000000-0000-40A6-950C-37C38AFA32B9} - C:\Program Files\5m8soump\5m8soump.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [navapp] C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [HELPER] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [5m8soump] C:\Program Files\5m8soump\5m8soump.exe
O4 - HKLM\..\Run: [second] C:\Documents and Settings\Joanne\Desktop\l2mfix\second.bat
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sympatico.ca
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbrowse…5.26/Hiwire.cab
O16 - DPF: {6BB594E2-6E4D-4CC9-98B0-931C323F9165} (DepHlp Control) - http://www.worldwinner.com/games/shared/dephlp.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://mirror.worldwinner.com/games/v41/sol/sol.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

ewido logs…

———————————————————
ewido security suite - Process report
———————————————————

+ Created on: 5:37:15 PM, 8/20/2005
+ Report-Checksum: B3CB0AEC

0: System Process
4: System Process
136: \SystemRoot\System32\smss.exe
188: \??\C:\WINDOWS\system32\csrss.exe
212: \??\C:\WINDOWS\system32\winlogon.exe
256: C:\WINDOWS\system32\services.exe
268: C:\WINDOWS\system32\lsass.exe
428: C:\WINDOWS\system32\svchost.exe
452: C:\WINDOWS\system32\svchost.exe
472: C:\WINDOWS\system32\NOTEPAD.EXE
808: C:\WINDOWS\Explorer.EXE
904: C:\Program Files\ewido\security suite\SecuritySuite.exe


———————————————————
ewido security suite - Startup report
———————————————————

+ Created on: 5:36:55 PM, 8/20/2005
+ Report-Checksum: 9F41A63F

Reg\HKLM\Run Motive SmartBridge C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
Reg\HKLM\Run NAV Agent C:\PROGRA~1\NORTON~1\navapw32.exe
Reg\HKLM\Run IPInSightLAN 01 "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe" -l
Reg\HKLM\Run IPInSightMonitor 01 "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe"
Reg\HKLM\Run QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
Reg\HKLM\Run EbatesMoeMoneyMaker0 "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
Reg\HKLM\Run Symantec NetDriver Monitor C:\PROGRA~1\SYMNET~1\SNDMon.exe
Reg\HKLM\Run SSC_UserPrompt C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
Reg\HKLM\Run navapp C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
Reg\HKLM\Run TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Reg\HKLM\Run ViewMgr C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
Reg\HKLM\Run ASDPLUGIN C:\WINDOWS\System32\canada.exe -N
Reg\HKLM\Run HELPER C:\WINDOWS\System32\canada.exe -N
Reg\HKLM\Run 5m8soump C:\Program Files\5m8soump\5m8soump.exe
Reg\HKLM\Run second C:\Documents and Settings\Joanne\Desktop\l2mfix\second.bat
Reg\HKCU\Run MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background
Shell\CommonStartup Microsoft Office.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
Shell\CommonStartup HotSync Manager.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
Shell\CommonStartup Kodak EasyShare software.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
Shell\CommonStartup Kodak software updater.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
Shell\UserStartup Greetings Workshop Reminders.lnk C:\Documents and Settings\Joanne\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk


joanne
here is a log report from the ewido free malware scan…

__________________________________________________
ewido security suite online scanner
http://www.ewido.net
__________________________________________________


Name: Spyware.Cookie.2o7
Path: C:\Documents and Settings\Joanne\Cookies\joanne@2o7[2].txt
Risk: Medium

Name: Spyware.Cookie.Adserver
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Questionmarket
Path: C:\Documents and Settings\Joanne\Cookies\joanne@questionmarket[1].txt
Risk: Medium

Name: Spyware.Cookie.Valuead
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\Documents and Settings\Joanne\Cookies\joanne@edge.ru4[1].txt
Risk: Medium

Name: Spyware.Cookie.Qksrv
Path: C:\Documents and Settings\Joanne\Cookies\joanne@qksrv[1].txt
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\Documents and Settings\Joanne\Cookies\joanne@hitbox[2].txt
Risk: Medium

Name: Spyware.Cookie.Adserver
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\Documents and Settings\Joanne\Cookies\joanne@trafficmp[1].txt
Risk: Medium

Name: Spyware.Cookie.Revenue
Path: C:\Documents and Settings\Joanne\Cookies\joanne@revenue[3].txt
Risk: Medium

Name: Spyware.Cookie.Gator
Path: C:\Documents and Settings\Joanne\Cookies\joanne@gator[1].txt
Risk: Medium

Name: Spyware.Cookie.Sexlist
Path: C:\Documents and Settings\Joanne\Cookies\joanne@sexlist[1].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Atdmt
Path: C:\Documents and Settings\Joanne\Cookies\joanne@atdmt[2].txt
Risk: Medium

Name: Spyware.Cookie.Tribalfusion
Path: C:\Documents and Settings\Joanne\Cookies\joanne@tribalfusion[1].txt
Risk: Medium

Name: Spyware.Cookie.Yieldmanager
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Revenue
Path: C:\Documents and Settings\Joanne\Cookies\joanne@revenue[2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\Documents and Settings\Joanne\Cookies\joanne@2o7[1].txt
Risk: Medium

Name: Spyware.Cookie.Paycounter
Path: C:\Documents and Settings\Joanne\Cookies\joanne@paycounter[2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\joanne@sextracker[1].txt
Risk: Medium

Name: Spyware.Cookie.Casalemedia
Path: C:\Documents and Settings\Joanne\Cookies\joanne@casalemedia[2].txt
Risk: Medium

Name: Spyware.Cookie.Gator
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: C:\Documents and Settings\Joanne\Cookies\joanne@serving-sys[2].txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: C:\Documents and Settings\Joanne\Cookies\[removed]-sys[1].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Xxxcounter
Path: C:\Documents and Settings\Joanne\Cookies\joanne@xxxcounter[1].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\joanne@sextracker[3].txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Pro-market
Path: C:\Documents and Settings\Joanne\Cookies\joanne@pro-market[2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Paycounter
Path: C:\Documents and Settings\Joanne\Cookies\joanne@paycounter[1].txt
Risk: Medium

Name: Spyware.Cookie.Bluestreak
Path: C:\Documents and Settings\Joanne\Cookies\joanne@bluestreak[1].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Pro-market
Path: C:\Documents and Settings\Joanne\Cookies\joanne@pro-market[3].txt
Risk: Medium

Name: Spyware.Cookie.Sexlist
Path: C:\Documents and Settings\Joanne\Cookies\joanne@sexlist[3].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Clickzs
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: C:\Documents and Settings\Joanne\Cookies\joanne@serving-sys[1].txt
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Paypopup
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Liveperson
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\Documents and Settings\Joanne\Cookies\joanne@hitbox[1].txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Xxxcounter
Path: C:\Documents and Settings\Joanne\Cookies\joanne@xxxcounter[3].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: C:\Documents and Settings\Joanne\Cookies\[removed]-sys[3].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Questionmarket
Path: C:\Documents and Settings\Joanne\Cookies\joanne@questionmarket[2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\joanne@sextracker[4].txt
Risk: Medium

Name: Spyware.Cookie.Onestat
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Overture
Path: C:\Documents and Settings\Joanne\Cookies\joanne@overture[2].txt
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Paypopup
Path: C:\Documents and Settings\Joanne\Cookies\joanne@paypopup[1].txt
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Paypopup
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][4].txt
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\Documents and Settings\Joanne\Cookies\joanne@edge.ru4[2].txt
Risk: Medium

Name: Spyware.Cookie.Casalemedia
Path: C:\Documents and Settings\Joanne\Cookies\joanne@casalemedia[3].txt
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\Documents and Settings\Joanne\Cookies\joanne@trafficmp[2].txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\Documents and Settings\Joanne\Cookies\joanne@2o7[3].txt
Risk: Medium

Name: Spyware.Cookie.Adserver
Path: C:\Documents and Settings\Joanne\Cookies\[removed][3].txt
Risk: Medium

Name: Spyware.Cookie.Addynamix
Path: C:\Documents and Settings\Joanne\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Yieldmanager
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Paypopup
Path: C:\Documents and Settings\Joanne\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Qksrv
Path: C:\Documents and Settings\Joanne\Cookies\joanne@qksrv[3].txt
Risk: Medium

Name: Spyware.BrilliantDigital
Path: HKLM\SOFTWARE\Classes\.s3d
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\AdAgent.AdvertisementAgent
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\AdAgent.AdvertisementAgent\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\AdAgent.BannerListItem
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\AdAgent.BannerListItem\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\AdAgent.CompositeItem
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\AdAgent.CompositeItem\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\AdAgent.SpotListItem
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\AdAgent.SpotListItem\CLSID
Risk: High

Name: Spyware.Altnet
Path: HKLM\SOFTWARE\Classes\AppID\adm.EXE
Risk: High

Name: Spyware.Altnet
Path: HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{08E05EEE-5EE9-11D4-9CAF-00D0B76063FD}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{11032FC2-C2F4-11D3-AD67-009027B8ADBC}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{11032FC2-C2F5-11D3-AD67-009027B8ADBC}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{28F00B04-DC4E-11d3-ABEC-005004A44EEB}
Risk: High

Name: Spyware.BroadCastPC
Path: HKLM\SOFTWARE\Classes\CLSID\{28F00B0F-DC4E-11d3-ABEC-005004A44EEB}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{28F00B20-DC4E-11d3-ABEC-005004A44EEB}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{28F00B21-DC4E-11d3-ABEC-005004A44EEB}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{315FFE67-CEBE-11D3-AD70-009027B8ADBC}
Risk: High

Name: Spyware.MyWebSearch
Path: HKLM\SOFTWARE\Classes\CLSID\{4E7BD74F-2B8D-469E-90F0-F66AB581A933}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{5CA9D47F-4BBC-45E0-815F-670AE736A678}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{5DCDE22E-E64F-11D3-AD74-009027B8ADBC}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{5DCDE22E-E650-11D3-AD74-009027B8ADBC}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{80F1B906-D066-11D3-AD70-009027B8ADBC}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{BCDDAB74-C3A8-11D3-AD69-009027B8ADBC}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{C357398A-8E21-4505-8BD7-784A4E9AC659}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{C357398B-8E21-4505-8BD7-784A4E9AC659}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\CLSID\{C357398C-8E21-4505-8BD7-784A4E9AC659}
Risk: High

Name: Spyware.SideSearch
Path: HKLM\SOFTWARE\Classes\CLSID\{FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\Hiwire.Register
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\Hiwire.Register\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\Hiwire.Register\CurVer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AdPlayer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AdPlayer\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AdPlayer\CurVer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AdScheduler
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AdScheduler\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AdScheduler\CurVer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AudioPlayers
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AudioPlayers\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.AudioPlayers\CurVer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RadioPlayers
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RadioPlayers\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RadioPlayers\CurVer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RealAdPlayer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RealAdPlayer\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RealAdPlayer\CurVer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RREventManager
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RREventManager\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWAdInsertion.RREventManager\CurVer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWWebPlayer.WebPlayer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWWebPlayer.WebPlayer\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\HWWebPlayer.WebPlayer\CurVer
Risk: High

Name: Spyware.InstaFinder
Path: HKLM\SOFTWARE\Classes\instafink.INSTAFINK
Risk: High

Name: Spyware.InstaFinder
Path: HKLM\SOFTWARE\Classes\instafink.INSTAFINK\Clsid
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\RMActiveX.RMPlayer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\RMActiveX.RMPlayer\CLSID
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\RMActiveX.RMPlayer\CurVer
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\TypeLib\{08E05EE1-5EE9-11D4-9CAF-00D0B76063FD}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\TypeLib\{96B2D8D3-E66D-11D3-AD74-009027B8ADBC}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\TypeLib\{EDC2D623-4D9E-4C3E-843F-74B1B2429B43}
Risk: High

Name: Spyware.HiWire
Path: HKLM\SOFTWARE\Classes\TypeLib\{F5EE52D3-2ECC-409E-A92F-A73F2B8DD407}
Risk: High

Name: Spyware.BroadCastPC
Path: HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{28F00B0F-DC4E-11D3-ABEC-005004A44EEB}
Risk: High

Name: Spyware.Alexa
Path: HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Risk: High

Name: Spyware.WebRebates
Path: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins
Risk: High

Name: Spyware.EliteBar
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EliteBar Internet Explorer Toolbar
Risk: High

Name: Spyware.NavExcel
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NavHelper
Risk: High

Name: Spyware.MoneyMaker
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\unebmm350
Risk: High

Name: Spyware.NavExcel
Path: HKLM\SOFTWARE\NavExcel
Risk: High

Name: Spyware.NavExcel
Path: HKLM\SOFTWARE\NavExcel\NavHelper
Risk: High

Name: Spyware.NavExcel
Path: HKLM\SOFTWARE\NavExcel\NavHelper\v2.0.4d
Risk: High

Name: Spyware.MoneyMaker
Path: HKU\S-1-5-21-220523388-1202660629-1060284298-1003\Software\Microsoft\Internet Explorer\Extensions\{6685509E-B47B-4f47-8E16-9A5F3A62F683}
Risk: High

Name: Spyware.MoneyMaker
Path: HKU\S-1-5-21-220523388-1202660629-1060284298-1003\Software\Microsoft\Internet Explorer\MenuExt\Ebates
Risk: High

Name: Spyware.ClearSearch
Path: [1180] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [1328] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [1336] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [1344] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [1352] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [1420] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [1808] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [2568] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [2764] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: [3908] C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Dialer.Generic
Path: C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\T0GZI1ZL\Canada[1].exe
Risk: High

Name: Spyware.EliteBar
Path: C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\T0GZI1ZL\proxy_inst[1].exe
Risk: High

Name: Dialer.Generic
Path: C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SVONCLGD\canada[1].exe
Risk: High

Name: Dialer.Generic
Path: C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6DUL07DC\Canada[1].exe
Risk: High

Name: Spyware.EliteBar
Path: C:\WINDOWS\system32\shawn_1.dll
Risk: High

Name: TrojanDownloader.Rameh.b
Path: C:\WINDOWS\system32\m3tsp8.dll
Risk: High

Name: Dialer.Generic
Path: C:\WINDOWS\system32\canada.exe
Risk: High

Name: Spyware.BargainBuddy
Path: C:\WINDOWS\system32\BO2803040128.dll
Risk: High

Name: Spyware.BargainBuddy
Path: C:\WINDOWS\system32\SHAgentNew.dll
Risk: High

Name: Dialer.Generic
Path: C:\WINDOWS\system32\temp532.exe
Risk: High

Name: Spyware.BargainBuddy
Path: C:\WINDOWS\system32\BO2802040113.dll
Risk: High

Name: Spyware.BargainBuddy
Path: C:\WINDOWS\system32\chktrust.exe
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\dmfiles.cab/AltnetUninstall.exe
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\dmfiles.cab/asmend.exe
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\pmexe.cab/Points Manager.exe
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\pmfiles.cab/setup.cab/PMuninstall.bde
Risk: High

Name: Adware.BrilliantDigital
Path: C:\WINDOWS\Temp\Altnet\pmfiles.cab/sysdetect.dll
Risk: Medium

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\Setup.exe
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\adm4.dll
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\adm25.dll
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\adm.exe
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\admdloader.dll
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\admfdi.dll
Risk: High

Name: Spyware.Altnet
Path: C:\WINDOWS\Temp\Altnet\admprog.dll
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall5_64.exe
Risk: High

Name: TrojanDropper.Small.ff
Path: C:\WINDOWS\iNetPal\m3tsp8.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall6_30.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall6_10.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall6_22.exe
Risk: High

Name: Dialer.Generic
Path: C:\WINDOWS\canada.exe
Risk: High

Name: Spyware.Hijacker.Generic
Path: C:\WINDOWS\protector.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall6_38.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall4_50.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall4_80.exe
Risk: High

Name: Dialer.Generic
Path: C:\WINDOWS\aconti.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall5_20.exe
Risk: High

Name: Dialer.Generic
Path: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4KE1BPB1\canada[1].exe
Risk: High

Name: Spyware.Cookie.Bfast
Path: C:\Documents and Settings\Administrator\Cookies\administrator@bfast[1].txt
Risk: Medium

Name: Spyware.P2PNetworking
Path: C:\Documents and Settings\Joanne\Local Settings\Temp\p2psetup.exe
Risk: High

Name: Spyware.Altnet
Path: C:\Documents and Settings\Joanne\Local Settings\Temp\asmfiles.cab/asm.exe
Risk: High

Name: Spyware.Altnet
Path: C:\Documents and Settings\Joanne\Local Settings\Temp\asmfiles.cab/asmps.dll
Risk: High

Name: Spyware.Hijacker.Generic
Path: C:\Documents and Settings\Joanne\Local Settings\Temp\Temporary Internet Files\Content.IE5\K5ER4TMZ\protector_update[1].exe
Risk: High

Name: Spyware.EliteBar
Path: C:\Documents and Settings\Joanne\Local Settings\Temp\Temporary Internet Files\Content.IE5\41KXW5GT\sideb[1].exe
Risk: High

Name: Spyware.Altnet
Path: C:\Documents and Settings\Joanne\Local Settings\Temp\__unin__.exe
Risk: High

Name: Spyware.EliteBar
Path: C:\Documents and Settings\Joanne\Local Settings\Temporary Internet Files\Content.IE5\OXARS52F\proxy_inst[2].exe
Risk: High

Name: Spyware.EliteBar
Path: C:\Documents and Settings\Joanne\Local Settings\Temporary Internet Files\Content.IE5\OXARS52F\proxy_inst[1].exe
Risk: High

Name: Spyware.EliteBar
Path: C:\Documents and Settings\Joanne\Local Settings\Temporary Internet Files\Content.IE5\89M58RG9\kw[1].exe
Risk: High

Name: Spyware.EliteBar
Path: C:\Documents and Settings\Joanne\Local Settings\Temporary Internet Files\Content.IE5\89M58RG9\EliteSideBar8[1].dll
Risk: High

Name: TrojanDownloader.WinShow.m
Path: C:\Documents and Settings\Joanne\Application Data\winshow\winshow.new
Risk: High

Name: TrojanDownloader.WinShow.l
Path: C:\Documents and Settings\Joanne\Application Data\winlink\winlink.new
Risk: High

Name: Spyware.Cookie.Atdmt
Path: :mozilla.23:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.27:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.28:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.29:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.30:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.31:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.32:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.33:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.34:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.35:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.36:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.37:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.38:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.39:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: :mozilla.40:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.41:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.42:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.43:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.44:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.45:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.46:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: :mozilla.47:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.247realmedia
Path: :mozilla.56:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.247realmedia
Path: :mozilla.58:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.247realmedia
Path: :mozilla.59:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.247realmedia
Path: :mozilla.60:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Adtech
Path: :mozilla.72:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Adtech
Path: :mozilla.73:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Casalemedia
Path: :mozilla.79:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Casalemedia
Path: :mozilla.80:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Casalemedia
Path: :mozilla.81:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Centrport
Path: :mozilla.83:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Centrport
Path: :mozilla.84:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.90:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.91:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.92:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.93:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.94:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.95:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.96:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.97:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.98:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.99:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.100:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.101:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.102:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.103:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.104:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.105:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.106:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.107:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.108:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Sexcounter
Path: :mozilla.109:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Paycounter
Path: :mozilla.146:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Qksrv
Path: :mozilla.152:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Qksrv
Path: :mozilla.153:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Questionmarket
Path: :mozilla.154:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: :mozilla.156:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: :mozilla.157:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: :mozilla.158:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: :mozilla.159:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Statcounter
Path: :mozilla.161:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Statcounter
Path: :mozilla.162:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Statcounter
Path: :mozilla.163:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Statcounter
Path: :mozilla.164:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: :mozilla.172:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Adserver
Path: :mozilla.181:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Yieldmanager
Path: :mozilla.183:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Yieldmanager
Path: :mozilla.184:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Yieldmanager
Path: :mozilla.185:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Yieldmanager
Path: :mozilla.186:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Yieldmanager
Path: :mozilla.187:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: :mozilla.190:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Liveperson
Path: :mozilla.208:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Liveperson
Path: :mozilla.209:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Liveperson
Path: :mozilla.210:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Liveperson
Path: :mozilla.211:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Googleadservices
Path: :mozilla.236:C:\Documents and Settings\Joanne\Application Data\Mozilla\Profiles\default\s0s6cnm5.slt\cookies.txt
Risk: Medium

Name: Spyware.404Search
Path: C:\Program Files\INSTAFINK
Risk: High

Name: Spyware.404Search
Path: C:\Program Files\INSTAFINK\Uninstall.exe
Risk: High

Name: Spyware.404Search
Path: C:\Program Files\INSTAFINK\Cache
Risk: High

Name: Spyware.404Search
Path: C:\Program Files\INSTAFINK\Cache\NewCfg
Risk: High

Name: Spyware.404Search
Path: C:\Program Files\INSTAFINK\Cache\instafinktb0302.cfg
Risk: High

Name: Spyware.404Search
Path: C:\Program Files\INSTAFINK\instafink.dll
Risk: High

Name: Spyware.404Search
Path: C:\Program Files\INSTAFINK\InstaFinderK_inst.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\Program Files\filesubmit\3dfishd23.exe\nnez_388.exe
Risk: High

Name: TrojanDownloader.Agent.mh
Path: C:\Program Files\Lycos\sst.dll
Risk: High

Name: Spyware.NavExcel
Path: C:\Program Files\NavExcel\NavHelper\v2.0.4d\v2.0.4d.cab/NHelper.dll
Risk: High

Name: Spyware.NavExcel
Path: C:\Program Files\NavExcel\NavHelper\v2.0.4d\v2.0.4d.cab/NHUninstaller.exe
Risk: High

Name: Spyware.NavExcel
Path: C:\Program Files\NavExcel\NavHelper\v2.0.4d\v2.0.4d.cab/NHUpdater.exe
Risk: High

Name: Spyware.NavExcel
Path: C:\Program Files\NavExcel\NavHelper\v2.0.4d\v2.0.4d.cab/navapp.exe
Risk: High

Name: Spyware.NavExcel
Path: C:\Program Files\NavExcel\NavHelper\v2.0.4d\NHelper.dll
Risk: High

Name: Spyware.NavExcel
Path: C:\Program Files\NavExcel\NavHelper\v2.0.4d\NHUninstaller.exe
Risk: High

Name: Spyware.NavExcel
Path: C:\Program Files\NavExcel\NavHelper\v2.0.4d\NHUpdater.exe
Risk: High

Name: Spyware.WebRebates
Path: C:\Program Files\Ebates_MoeMoneyMaker\disp350.exe
Risk: High

Name: Spyware.TopMoxie
Path: C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Sy350\350_1.dat
Risk: High

Name: Spyware.ClearSearch
Path: C:\Program Files\5m8soump\up3n4jks.DLL
Risk: High

Name: Spyware.ClearSearch
Path: C:\Program Files\5m8soump\y13vmm0g.DLL
Risk: High

Name: Spyware.ClearSearch
Path: C:\Program Files\5m8soump\5m8soump1\5m8soump1.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\Program Files\5m8soump\5m8soump1\5m8soump1.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\Program Files\5m8soump\__delete_on_reboot__5m8soump.DLL
Risk: High

Name: Spyware.ClearSearch
Path: C:\Program Files\5m8soump\5m8soump.DLL
Risk: High

Name: Dialer.Generic
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1109\A0082999.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1109\A0083000.DLL
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1109\A0083003.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1109\A0083004.exe
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0083110.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0083113.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0083115.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0083119.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0083122.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0083123.exe
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0084146.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0084147.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0084151.DLL
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0084154.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0084155.exe
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1112\A0084160.exe
Risk: High

Name: Spyware.404Search.h
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1113\A0084165.exe
Risk: High

Name: Spyware.404Search
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1113\A0084166.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084206.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084207.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084208.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084211.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084212.exe
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084244.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084246.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084247.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084249.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084252.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1114\A0084253.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084256.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084257.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084260.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084262.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084263.exe
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084382.exe
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084383.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084393.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084396.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084397.exe
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084422.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084427.dll
Risk: High

Name: Spyware.EliteBar
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084428.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084430.DLL
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084433.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1115\A0084434.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1041\A0078485.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1041\A0078486.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1041\A0078487.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1045\A0078636.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1045\A0078637.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1045\A0078638.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1047\A0078676.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1047\A0078677.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1047\A0078678.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1048\A0078689.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1048\A0078690.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1048\A0078691.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1050\A0078720.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1050\A0078721.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1050\A0078722.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1051\A0078748.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1051\A0078749.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1051\A0078750.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1051\A0078759.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1051\A0078760.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1051\A0078761.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1052\A0078804.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1052\A0078824.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1052\A0078837.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1052\A0078838.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1052\A0078839.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1054\A0078883.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1054\A0078884.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1054\A0078885.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1056\A0078940.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1056\A0078941.dll
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\_restore{132A1E41-D962-4554-A69B-AC8026E18E30}\RP1056\A0078942.exe
Risk: High

Name: Spyware.ClearSearch
Path: C:\System Volume Information\
the option on the free malware scan (online on the exido site) is to "remove all infections", which will permanently remove all the above files… the last report is from that scan. should i remove these files? or the ewido i downloaded produced a reoprt which is in the previous message. this also has given me an option to remove files… which is the correct one? thanks! jo
ok here is the latest and greatest hijack this log file…
next steps?
jo

Logfile of HijackThis v1.99.1
Scan saved at 8:17:08 PM, on 8/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\5m8soump\18129976.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\Documents and Settings\Joanne\Desktop\hijak this\HijackThis.exe
C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://iesearch.sympatico.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sympatico.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adshttp.com/servlet/ajrotator/12844…L?zone=enternet
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico Internet Service
O2 - BHO: (no name) - {00000000-0000-40A6-950C-37C38AFA32B9} - C:\Program Files\5m8soump\5m8soump.dll (file missing)
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [navapp] C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [HELPER] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [5m8soump] C:\Program Files\5m8soump\5m8soump.exe
O4 - HKLM\..\Run: [second] C:\Documents and Settings\Joanne\Desktop\l2mfix\second.bat
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sympatico.ca
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6BB594E2-6E4D-4CC9-98B0-931C323F9165} (DepHlp Control) - http://www.worldwinner.com/games/shared/dephlp.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37240.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://mirror.worldwinner.com/games/v41/sol/sol.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS1\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: Domain = sympatico.ca
O17 - HKLM\System\CS2\Services\Tcpip\..\{05BAB4B5-A97D-4AE4-A170-29FA20C6904B}: NameServer = 192.168.2.1
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI