Spyware / Malware / Virus Removal

Hijack Log - plse help

5 min read

Looking for the outcome? Ask AI

mikebrittan Topic Starter

Post #1September 1, 2005, 7:12 PM UTC last edited September 1, 2005, 7:46 PM UTC

Please help!!

Logfile of HijackThis v1.99.1
Scan saved at 19:59:42, on 01/09/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINNT\etb\pokapoka61.exe
C:\WINNT\system32\cmd.exe
C:\PROGRA~1\TASKBA~1\TaskBar.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\wuauclt.exe
C:\WINNT\explorer.exe
C:\Documents and Settings\Mike\Desktop\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.freeserve.com/iesearch/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Installer] C:\WINNT\system32\ntdll.exe
O4 - HKLM\..\Run: [Windows Spooler] C:\WINNT\system32\spoolsv32.exe
O4 - HKLM\..\Run: [Windows DLL Host] C:\WINNT\system32\dllhost32.exe
O4 - HKCU\..\Run: [Taskbar Hide] C:\PROGRA~1\TASKBA~1\TaskBar.exe -Start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.wanadoo.co.uk/time/reg/anytime/choice2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS

mikebrittan

Post #2September 3, 2005, 1:45 PM UTC

Micah_6:8

Post #3September 3, 2005, 2:55 PM UTC

Greetings and welcome to TomCoyote.org!

I want to check some things before beginning any cleaning operations.

Run Hijack This!.

Click on Open Misc Tools section

To the right of Generate Startuplist log, there are two boxes.

Check them both, then click Generate Startuplist log.

"Copy/paste" the startuplist log into this thread.

mikebrittan

Post #4September 3, 2005, 4:12 PM UTC

Here you go.. what do you think?

StartupList report, 03/09/2005, 17:08:47
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Mike\Desktop\hjt\HijackThis.EXE
Detected: Windows 2000 SP4 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\TASKBA~1\TaskBar.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\WINNT\etb\pokapoka65.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\explorer.exe
C:\Documents and Settings\Mike\Desktop\hjt\HijackThis.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Mike\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon
SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
NeroCheck = C:\WINNT\system32\NeroCheck.exe
NvCplDaemon = RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
NvMediaCenter = RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
Windows Installer = C:\WINNT\system32\ntdll.exe
Windows Spooler = C:\WINNT\system32\spoolsv32.exe
Windows DLL Host = C:\WINNT\system32\dllhost32.exe
lsass = c:\winnt\system32\elitevlv32.exe
SystemService = C:\WINNT\etb\pokapoka63.exe
System service63 = C:\WINNT\etb\pokapoka63.exe
System service65 = C:\WINNT\etb\pokapoka65.exe

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Taskbar Hide = C:\PROGRA~1\TASKBA~1\TaskBar.exe -Start

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

————————————————–

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINNT\System32\mshta.exe "%1" %*

————————————————–

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

————————————————–

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINNT\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = "C:\WINNT\System32\shmgrate.exe" OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = "C:\WINNT\System32\shmgrate.exe" OCInstallUserConfigOE

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{6A5110B5-E14B-4268-A065-EF89FF33C325}] *
StubPath = regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\wmp.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\System32\ie4uinit.exe

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = %SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl

————————————————–

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

————————————————–

Load/Run keys from C:\WINNT\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

————————————————–

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINNT\system32\ssflwbox.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–

Checking for EXPLORER.EXE instances:

C:\WINNT\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINNT\Explorer\Explorer.exe: not present
C:\WINNT\System\Explorer.exe: not present
C:\WINNT\System32\Explorer.exe: not present
C:\WINNT\Command\Explorer.exe: not present
C:\WINNT\Fonts\Explorer.exe: not present

————————————————–

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

————————————————–

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINNT
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

————————————————–

Enumerating Browser Helper Objects:

*No BHO's found*

————————————————–

Enumerating Task Scheduler jobs:

Kazaa Lite.job

————————————————–

Enumerating Download Program Files:

[DirectAnimation Java Classes]
CODEBASE = file://C:\WINNT\Java\classes\dajava.cab
OSD = C:\WINNT\Downloaded Program Files\DirectAnimation Java Classes.osd

[Microsoft XML Parser for Java]
CODEBASE = file://C:\WINNT\Java\classes\xmldso.cab
OSD = C:\WINNT\Downloaded Program Files\Microsoft XML Parser for Java.osd

[{31564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/wmvax.cab

[{32564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/wmv8ax.cab

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB

[Malicious Software Removal Tool]
InProcServer32 = C:\WINNT\Downloaded Program Files\WebCleaner.dll
CODEBASE = http://download.microsoft.com/download/b/d…/WebCleaner.cab

[EPUImageControl Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\EPUWALcontrol.dll
CODEBASE = http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab

[BDSCANONLINE Control]
InProcServer32 = C:\WINNT\DOWNLO~1\oscan8.ocx
CODEBASE = http://www.bitdefender.com/scan8/oscan8.cab

[HouseCall Control]
InProcServer32 = C:\WINNT\DOWNLO~1\xscan53.ocx
CODEBASE = http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab

[Java Plug-in 1.5.0_02]
InProcServer32 = C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/…7903.5865856481

[MsnMessengerSetupDownloadControl Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\MsnMessengerSetupDownloader.ocx
CODEBASE = http://messenger.msn.com/download/msnmesse…pdownloader.cab

[Java Plug-in 1.4.2_04]
InProcServer32 = C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
CODEBASE = http://java.sun.com/products/plugin/autodl…indows-i586.cab

[Java Plug-in 1.4.2_05]
InProcServer32 = C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
CODEBASE = http://java.sun.com/products/plugin/autodl…indows-i586.cab

[Java Plug-in 1.4.2_06]
InProcServer32 = C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
CODEBASE = http://java.sun.com/products/plugin/autodl…indows-i586.cab

[Java Plug-in 1.5.0_02]
InProcServer32 = C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
CODEBASE = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\system32\macromed\flash\Flash.ocx
CODEBASE = http://active.macromedia.com/flash2/cabs/swflash.cab

————————————————–

Enumerating Winsock LSP files:

NameSpace #1: C:\WINNT\System32\rnr20.dll
NameSpace #2: C:\WINNT\System32\winrnr.dll
Protocol #1: C:\Program Files\NewDotNet\newdotnet6_38.dll
Protocol #2: C:\Program Files\NewDotNet\newdotnet6_38.dll
Protocol #3: C:\WINNT\system32\msafd.dll
Protocol #4: C:\WINNT\system32\msafd.dll
Protocol #5: C:\WINNT\system32\msafd.dll
Protocol #6: C:\WINNT\system32\rsvpsp.dll
Protocol #7: C:\WINNT\system32\rsvpsp.dll
Protocol #8: C:\WINNT\system32\msafd.dll
Protocol #9: C:\WINNT\system32\msafd.dll
Protocol #10: C:\WINNT\system32\msafd.dll
Protocol #11: C:\WINNT\system32\msafd.dll
Protocol #12: C:\WINNT\system32\msafd.dll
Protocol #13: C:\WINNT\system32\msafd.dll
Protocol #14: C:\WINNT\system32\msafd.dll
Protocol #15: C:\WINNT\system32\msafd.dll
Protocol #16: C:\WINNT\system32\msafd.dll
Protocol #17: C:\WINNT\system32\msafd.dll
Protocol #18: C:\WINNT\system32\msafd.dll
Protocol #19: C:\WINNT\system32\msafd.dll
Protocol #20: C:\Program Files\NewDotNet\newdotnet6_38.dll
Protocol #21: C:\Program Files\NewDotNet\newdotnet6_38.dll

————————————————–

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (autostart)
Service for Realtek AC97 Audio (WDM): system32\drivers\ALCXWDM.SYS (manual start)
Alerter: %SystemRoot%\System32\services.exe (manual start)
Application Management: %SystemRoot%\system32\services.exe (manual start)
RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
bfastfao: \??\C:\DOCUME~1\Mike\LOCALS~1\Temp\bfastfao.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k BITSgroup (autostart)
Computer Browser: %SystemRoot%\System32\services.exe (manual start)
Closed Caption Decoder: System32\DRIVERS\CCDECODE.sys (manual start)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: C:\WINNT\System32\cisvc.exe (disabled)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
DHCP Client: %SystemRoot%\System32\services.exe (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Logical Disk Manager Driver: System32\drivers\dmio.sys (system)
dmload: System32\drivers\dmload.sys (system)
Logical Disk Manager: %SystemRoot%\System32\services.exe (autostart)
Microsoft DirectMusic SW Synth (WDM): system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\services.exe (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINNT\System32\svchost.exe -k netsvcs (manual start)
Fax Service: %systemroot%\system32\faxsvc.exe (manual start)
Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
hbaheed.sys: \??\C:\WINNT\system32\hbaheed.sys (manual start)
hbaieee.sys: \??\C:\WINNT\system32\hbaieee.sys (manual start)
hbikeeo.sys: \??\C:\WINNT\system32\hbikeeo.sys (manual start)
hcaceet.sys: \??\C:\WINNT\system32\hcaceet.sys (manual start)
hcawyet.sys: \??\C:\WINNT\system32\hcawyet.sys (manual start)
headeec.sys: \??\C:\WINNT\system32\headeec.sys (manual start)
heijyeq.sys: \??\C:\WINNT\system32\heijyeq.sys (manual start)
hfafeef.sys: \??\C:\WINNT\system32\hfafeef.sys (manual start)
hgaheei.sys: \??\C:\WINNT\system32\hgaheei.sys (manual start)
hganeeo.sys: \??\C:\WINNT\system32\hganeeo.sys (manual start)
hhihyer.sys: \??\C:\WINNT\system32\hhihyer.sys (manual start)
hiaeeeh.sys: \??\C:\WINNT\system32\hiaeeeh.sys (manual start)
hiameep.sys: \??\C:\WINNT\system32\hiameep.sys (manual start)
Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (autostart)
hiikeeb.sys: \??\C:\WINNT\system32\hiikeeb.sys (manual start)
hiinyee.sys: \??\C:\WINNT\system32\hiinyee.sys (manual start)
hjaeyei.sys: \??\C:\WINNT\system32\hjaeyei.sys (manual start)
hjaoyes.sys: \??\C:\WINNT\system32\hjaoyes.sys (manual start)
hjapeet.sys: \??\C:\WINNT\system32\hjapeet.sys (manual start)
hjawyeg.sys: \??\C:\WINNT\system32\hjawyeg.sys (manual start)
hjifyer.sys: \??\C:\WINNT\system32\hjifyer.sys (manual start)
hkadyei.sys: \??\C:\WINNT\system32\hkadyei.sys (manual start)
hlapeeb.sys: \??\C:\WINNT\system32\hlapeeb.sys (manual start)
hliqeek.sys: \??\C:\WINNT\system32\hliqeek.sys (manual start)
hmaeyel.sys: \??\C:\WINNT\system32\hmaeyel.sys (manual start)
hmaiyep.sys: \??\C:\WINNT\system32\hmaiyep.sys (manual start)
hmieeet.sys: \??\C:\WINNT\system32\hmieeet.sys (manual start)
hmieyet.sys: \??\C:\WINNT\system32\hmieyet.sys (manual start)
hmiheec.sys: \??\C:\WINNT\system32\hmiheec.sys (manual start)
hoafeeo.sys: \??\C:\WINNT\system32\hoafeeo.sys (manual start)
hoawyel.sys: \??\C:\WINNT\system32\hoawyel.sys (manual start)
hoikyeh.sys: \??\C:\WINNT\system32\hoikyeh.sys (manual start)
hoiueer.sys: \??\C:\WINNT\system32\hoiueer.sys (manual start)
hqagyer.sys: \??\C:\WINNT\system32\hqagyer.sys (manual start)
hragyes.sys: \??\C:\WINNT\system32\hragyes.sys (manual start)
hraqyei.sys: \??\C:\WINNT\system32\hraqyei.sys (manual start)
hsabeeo.sys: \??\C:\WINNT\system32\hsabeeo.sys (manual start)
hsacyep.sys: \??\C:\WINNT\system32\hsacyep.sys (manual start)
hsaqeej.sys: \??\C:\WINNT\system32\hsaqeej.sys (manual start)
hsibeec.sys: \??\C:\WINNT\system32\hsibeec.sys (manual start)
hsiveec.sys: \??\C:\WINNT\system32\hsiveec.sys (manual start)
hsiweed.sys: \??\C:\WINNT\system32\hsiweed.sys (manual start)
htaheeb.sys: \??\C:\WINNT\system32\htaheeb.sys (manual start)
htahyeb.sys: \??\C:\WINNT\system32\htahyeb.sys (manual start)
htalyef.sys: \??\C:\WINNT\system32\htalyef.sys (manual start)
htaoyei.sys: \??\C:\WINNT\system32\htaoyei.sys (manual start)
hticyee.sys: \??\C:\WINNT\system32\hticyee.sys (manual start)
htimyeo.sys: \??\C:\WINNT\system32\htimyeo.sys (manual start)
huamyeh.sys: \??\C:\WINNT\system32\huamyeh.sys (manual start)
huiryea.sys: \??\C:\WINNT\system32\huiryea.sys (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
InterCheck Control: \??\C:\Program Files\Sophos SWEEP for NT\icntdrv5.sys (manual start)
InterCheck Filter: \??\C:\Program Files\Sophos SWEEP for NT\icntflt5.sys (manual start)
InterCheck Support 01: \??\C:\Program Files\Sophos SWEEP for NT\icntst01.sys (manual start)
InterCheck Support 02: \??\C:\Program Files\Sophos SWEEP for NT\icntst02.sys (manual start)
InterCheck Support 03: \??\C:\Program Files\Sophos SWEEP for NT\icntst03.sys (manual start)
InterCheck Support 04: \??\C:\Program Files\Sophos SWEEP for NT\icntst04.sys (manual start)
InterCheck Support 05: \??\C:\Program Files\Sophos SWEEP for NT\icntst05.sys (manual start)
InterCheck Support 06: \??\C:\Program Files\Sophos SWEEP for NT\icntst06.sys (manual start)
InterCheck Support 07: \??\C:\Program Files\Sophos SWEEP for NT\icntst07.sys (manual start)
InterCheck Support 08: \??\C:\Program Files\Sophos SWEEP for NT\icntst08.sys (manual start)
InterCheck Support 09: \??\C:\Program Files\Sophos SWEEP for NT\icntst09.sys (manual start)
InterCheck Support 10: \??\C:\Program Files\Sophos SWEEP for NT\icntst10.sys (manual start)
InterCheck Support 11: \??\C:\Program Files\Sophos SWEEP for NT\icntst11.sys (manual start)
InterCheck Support 12: \??\C:\Program Files\Sophos SWEEP for NT\icntst12.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (manual start)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Workstation: %SystemRoot%\System32\services.exe (autostart)
LexBce Server: C:\WINNT\system32\LEXBCES.EXE (autostart)
TCP/IP NetBIOS Helper Service: %SystemRoot%\System32\services.exe (autostart)
Messenger: %SystemRoot%\System32\services.exe (disabled)
NetMeeting Remote Desktop Sharing: C:\WINNT\System32\mnmsrvc.exe (disabled)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
BDA MPE Filter: System32\DRIVERS\MPE.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINNT\System32\msdtc.exe (manual start)
Windows Installer: C:\WINNT\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start)
Microsoft MPU-401 MIDI UART Driver: system32\drivers\msmpu401.sys (manual start)
NABTS/FEC VBI Codec: System32\DRIVERS\NABTSFEC.sys (manual start)
Microsoft TV/Video Connection: system32\DRIVERS\NdisIP.sys (manual start)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (manual start)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (manual start)
NetDetect: \SystemRoot\system32\drivers\netdtect.sys (manual start)
Net Logon: %SystemRoot%\System32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Network Monitor Driver: System32\DRIVERS\NMnt.sys (manual start)
NetGroup Packet Filter Driver: system32\drivers\npf.sys (manual start)
NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
nv: system32\DRIVERS\nv4_mini.sys (manual start)
NVIDIA Display Driver Service: %SystemRoot%\system32\nvsvc32.exe (autostart)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
Parallel class driver: System32\DRIVERS\parallel.sys (manual start)
Parallel port driver: System32\DRIVERS\parport.sys (system)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
PCIIde: System32\DRIVERS\pciide.sys (system)
Padus ASPI Shell: system32\drivers\pfc.sys (manual start)
Logitech QuickCam Express(PID_0920): system32\DRIVERS\LV532AV.SYS (manual start)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Policy Agent: %SystemRoot%\System32\lsass.exe (autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
StarForce Protection Environment Driver v6: \SystemRoot\System32\drivers\prodrv06.sys (system)
StarForce Protection Helper Driver v2: System32\drivers\prohlp02.sys (system)
StarForce Protection Synchronization Driver v1: System32\drivers\prosync1.sys (system)
Protected Storage: %SystemRoot%\system32\services.exe (autostart)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
Microsoft Streaming Network Raw Channel Access: system32\drivers\RCA.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Remote Registry Service: %SystemRoot%\system32\regsvc.exe (disabled)
Remote Packet Capture Protocol v.0 (experimental): "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" (manual start)
Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe -s (manual start)
Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver: System32\DRIVERS\RTL8139.SYS (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card Helper: %SystemRoot%\System32\SCardSvr.exe (manual start)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\system32\MSTask.exe (disabled)
SecDrv: \??\C:\WINNT\system32\drivers\SECDRV.SYS (autostart)
RunAs Service: %SystemRoot%\system32\services.exe (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
StarForce Protection Helper Driver: System32\drivers\sfhlp01.sys (system)
Internet Connection Sharing: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
BDA Slip De-Framer: System32\DRIVERS\SLIP.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
STEC3: \??\C:\WINNT\system32\STEC3.sys (autostart)
BDA IPSink: System32\DRIVERS\StreamIP.sys (manual start)
Sophos Anti-Virus Network: "C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE" (autostart)
Sophos Anti-Virus: "C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS" (autostart)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
Microsoft System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
Telnet: %SystemRoot%\system32\tlntsvr.exe (disabled)
Distributed Link Tracking Client: %SystemRoot%\system32\services.exe (autostart)
Microsoft USB Universal Host Controller Driver: System32\DRIVERS\uhcd.sys (manual start)
Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (disabled)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
Microsoft USB Standard Hub Driver: System32\DRIVERS\usbhub.sys (manual start)
USB 2.0 Root Hub Support: System32\DRIVERS\usbhub20.sys (manual start)
Microsoft USB PRINTER Class: System32\DRIVERS\usbprint.sys (manual start)
USB Mass Storage Driver: System32\DRIVERS\USBSTOR.SYS (manual start)
Utility Manager: %SystemRoot%\System32\UtilMan.exe (manual start)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
VIA AGP Filter: System32\DRIVERS\viaagp1.sys (system)
VIA USB Filter: \SystemRoot\System32\Drivers\viausb.sys (manual start)
viaide: System32\DRIVERS\viaide.sys (system)
VIA USB Host Controller Lower Filter: \SystemRoot\System32\Drivers\vulfnth.sys (manual start)
VIA USB Roothub Lower Filter: \SystemRoot\System32\Drivers\vulfntr.sys (manual start)
Windows Time: %SystemRoot%\System32\services.exe (autostart)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
Winacpci: System32\DRIVERS\winacpci.sys (manual start)
Windows Management Instrumentation: %SystemRoot%\System32\WBEM\WinMgmt.exe (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Windows Management Instrumentation Driver Extensions: %SystemRoot%\system32\Services.exe (manual start)
World Standard Teletext Codec: System32\DRIVERS\WSTCODEC.SYS (manual start)
Automatic Updates: %systemroot%\system32\svchost.exe -k wugroup (autostart)
Wireless Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

————————————————–

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\System32\webcheck.dll
SysTray: stobject.dll

————————————————–
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

————————————————–

End of report, 35,469 bytes
Report generated in 0.320 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Micah_6:8

Post #5September 3, 2005, 4:33 PM UTC

Please download/unzip this:

LQfix.zip

Reboot in "safe" mode.

on the file you just unzipped (LQfix.bat)

A DOS window will appear. When it is finished running it will say "Done!!" and close.

After it closes, reboot in normal mode and post a new log file in this thread.

mikebrittan

Post #6September 3, 2005, 6:58 PM UTC

Sorry for the delay, the "virus" effect the .exe files so I can't open mozilla or IE, takes dozens of tries..

Here the log from Hijack (I hope thats what you were looking for!) I ran the .bat file

Logfile of HijackThis v1.99.1
Scan saved at 19:47:30, on 03/09/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\TASKBA~1\TaskBar.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\WINNT\system32\wuauclt.exe
C:\WINNT\explorer.exe
C:\WINNT\etb\pokapoka65.exe
C:\WINNT\etb\pokapoka63.exe
C:\Documents and Settings\Mike\Desktop\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.sitesearchcentral.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sitesearchcentral.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sitesearchcentral.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Installer] C:\WINNT\system32\ntdll.exe
O4 - HKLM\..\Run: [Windows Spooler] C:\WINNT\system32\spoolsv32.exe
O4 - HKLM\..\Run: [Windows DLL Host] C:\WINNT\system32\dllhost32.exe
O4 - HKLM\..\Run: [lsass] c:\winnt\system32\elitevlv32.exe
O4 - HKLM\..\Run: [System service65] C:\WINNT\etb\pokapoka65.exe
O4 - HKLM\..\Run: [SystemService] C:\WINNT\etb\pokapoka63.exe
O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
O4 - HKCU\..\Run: [Taskbar Hide] C:\PROGRA~1\TASKBA~1\TaskBar.exe -Start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.wanadoo.co.uk/time/reg/anytime/choice2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS

mikebrittan

Post #7September 3, 2005, 7:07 PM UTC

seems to be getting worse, pc is slowing down.. seems to be loads of process running when I look at task manager.. arghh

Micah_6:8

Post #8September 3, 2005, 7:11 PM UTC

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.sitesearchcentral.com/sp2.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sitesearchcentral.com/sp2.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sitesearchcentral.com/sp2.php

O4 - HKLM\..\Run: [Windows Installer] C:\WINNT\system32\ntdll.exe

O4 - HKLM\..\Run: [Windows DLL Host] C:\WINNT\system32\dllhost32.exe

O4 - HKLM\..\Run: [lsass] c:\winnt\system32\elitevlv32.exe

O4 - HKLM\..\Run: [System service65] C:\WINNT\etb\pokapoka65.exe

O4 - HKLM\..\Run: [SystemService] C:\WINNT\etb\pokapoka63.exe

O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\winnt\etb <— FOLDER

c:\winnt\system32\dllhost32.exe <— file

c:\winnt\system32\elitevlv32.exe <— file

c:\winnt\system32\ntdll.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread.

mikebrittan

Post #9September 3, 2005, 7:31 PM UTC

Hey.. seems better .. the error message I was getting has gone and I ran mozilla first time.. here's the new log file.. fantastic already!

Logfile of HijackThis v1.99.1
Scan saved at 20:26:53, on 03/09/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINNT\etb\pokapoka65.exe
C:\PROGRA~1\TASKBA~1\TaskBar.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\WINNT\system32\wuauclt.exe
C:\WINNT\explorer.exe
C:\Documents and Settings\Mike\Desktop\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Spooler] C:\WINNT\system32\spoolsv32.exe
O4 - HKLM\..\Run: [System service65] C:\WINNT\etb\pokapoka65.exe
O4 - HKCU\..\Run: [Taskbar Hide] C:\PROGRA~1\TASKBA~1\TaskBar.exe -Start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.wanadoo.co.uk/time/reg/anytime/choice2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS

Micah_6:8

Post #10September 3, 2005, 7:47 PM UTC

Download Killbox from here:

Killbox.zip

Unzip it, but don't run it yet.

Copy the file names in the quote box below to the clipboard by highlighting them and pressing
C (hold the key down, then press C):

C:\WINNT\system32\spoolsv32.exe
C:\WINNT\etb\pokapoka65.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [Windows Spooler] C:\WINNT\system32\spoolsv32.exe

O4 - HKLM\..\Run: [System service65] C:\WINNT\etb\pokapoka65.exe

Then click "Fix checked", and close Hijack This!

Run Killbox, click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new log file into this thread.

mikebrittan

Post #11September 3, 2005, 7:58 PM UTC

here goes.

Logfile of HijackThis v1.99.1
Scan saved at 20:55:08, on 03/09/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\TASKBA~1\TaskBar.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\WINNT\system32\wuauclt.exe
C:\WINNT\etb\pokapoka65.exe
C:\WINNT\explorer.exe
C:\Documents and Settings\Mike\Desktop\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [System service65] C:\WINNT\etb\pokapoka65.exe
O4 - HKCU\..\Run: [Taskbar Hide] C:\PROGRA~1\TASKBA~1\TaskBar.exe -Start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.wanadoo.co.uk/time/reg/anytime/choice2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS

Micah_6:8

Post #12September 3, 2005, 8:04 PM UTC

Go to:

Start –> Control Panel –> Add/Remove Programs

Remove New.Net or NewDotNet, then reboot.

If there is no listing for it, use the uninstaller at New.net

Use Procedure 4 to remove it. It requires that an internet connection be active while doing it. Reboot.

After removing it, post a new log file in this thread.

mikebrittan

Post #13September 3, 2005, 8:33 PM UTC

thanks for this…

Logfile of HijackThis v1.99.1
Scan saved at 21:30:53, on 03/09/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINNT\etb\pokapoka65.exe
C:\PROGRA~1\TASKBA~1\TaskBar.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\explorer.exe
C:\Documents and Settings\Mike\Desktop\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [System service65] C:\WINNT\etb\pokapoka65.exe
O4 - HKCU\..\Run: [Taskbar Hide] C:\PROGRA~1\TASKBA~1\TaskBar.exe -Start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.wanadoo.co.uk/time/reg/anytime/choice2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS

Micah_6:8

Post #14September 3, 2005, 8:41 PM UTC

Click here to download Ewido security suite - it is a trial version of the program.

Install Ewido security suite
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
Launch Ewido, there should be an icon on your desktop double-click it.
The program will now go to the main screen

You will need to update Ewido to the latest definition files.

On the left hand side of the main screen click update
Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.

After the definitions have been updated, close Ewido.

Do NOT run a scan yet.

Reboot in "safe" mode.

Now, run Ewido, then:

Click on scanner
Click on Complete System Scan and the scan will begin (do not open any folder's or open the windows control panel while the scan is in progress).
While the scan is in progress you will be prompted to clean files, click OK
When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report
Click Save report.
Save the report.txt file to your desktop.

Now close Ewido security suite.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [System service65] C:\WINNT\etb\pokapoka65.exe

Then click "Fix checked".

Reboot in "safe" mode.

Delete:

C:\WINNT\etb <– this folder

Reboot and "copy/paste" a new Hijack This! log file, and the report.txt file from the Ewido scan, into this thread.

mikebrittan

Post #15September 3, 2005, 9:54 PM UTC

Hi.. took a while.. hijack first

Logfile of HijackThis v1.99.1
Scan saved at 22:49:43, on 03/09/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\WINNT\explorer.exe
C:\Documents and Settings\Mike\Desktop\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Taskbar Hide] C:\PROGRA~1\TASKBA~1\TaskBar.exe -Start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.wanadoo.co.uk/time/reg/anytime/choice2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS

EWIDO REPORT

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 22:38:19, 03/09/2005
+ Report-Checksum: 3EC90ABD

+ Scan result:

HKLM\SOFTWARE\Classes\Bho8.adlog -> Spyware.Adlogix : Cleaned with backup
HKLM\SOFTWARE\Classes\Bho8.adlog\CLSID -> Spyware.Adlogix : Cleaned with backup
HKLM\SOFTWARE\Classes\Bho8.adlog\CurVer -> Spyware.Adlogix : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{22B9A67D-E689-44B6-B775-0E8FE84B4F9B} -> Spyware.Hijacker.Generic : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{21194DBC-E80C-4B83-8C82-74CBF52C8AAD} -> Spyware.Adlogix : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{E2C6E243-5F01-4031-9218-6178426985B1} -> Spyware.Adlogix : Cleaned with backup
HKLM\SOFTWARE\PerfectNav -> Spyware.KeenValue : Cleaned with backup
HKLM\SOFTWARE\saap -> Spyware.180Solutions : Cleaned with backup
HKU\S-1-5-21-57989841-920026266-1343024091-1000\Software\saap -> Spyware.180Solutions : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.80:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.104:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.110:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
:mozilla.111:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Xhit : Cleaned with backup
:mozilla.112:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Xhit : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Xhit : Cleaned with backup
:mozilla.114:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Xhit : Cleaned with backup
:mozilla.115:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Xhit : Cleaned with backup
:mozilla.123:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Spylog : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hotlog : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.142:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.143:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.144:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.154:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.160:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.162:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.163:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.164:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.167:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.168:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.172:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.174:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.176:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.177:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.190:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.191:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.198:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.199:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.200:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.201:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.220:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.221:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.222:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.223:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.239:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.240:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.241:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.256:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.257:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.258:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.259:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.260:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.261:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.262:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.263:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.264:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.265:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.266:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.267:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.268:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.269:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.270:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.272:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.297:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.298:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.299:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.300:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.301:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.302:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.303:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.304:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.305:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.306:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.307:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.308:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.309:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.310:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.311:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.312:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.315:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.378:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.414:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.415:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.416:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.417:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.428:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.434:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.449:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.450:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.475:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.476:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.479:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.480:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.482:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.483:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.492:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.493:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.494:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.495:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.497:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.498:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.499:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.531:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.532:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.533:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.540:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.542:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.543:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.544:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.545:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.547:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.552:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.553:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.554:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.555:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.556:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.557:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.558:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.563:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.564:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.588:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.593:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.602:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.604:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.630:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.633:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.653:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
:mozilla.654:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
:mozilla.656:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.658:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.663:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.676:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.677:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.690:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.691:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.700:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.701:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.702:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.703:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.704:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.745:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.750:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.758:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.759:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.772:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.773:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.774:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.776:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.777:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.779:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.782:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.801:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.802:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.803:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.804:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.818:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.821:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup
:mozilla.822:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.844:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.851:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.852:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.853:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.854:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.855:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.856:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.857:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.858:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.884:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.887:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.889:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.890:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.891:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.892:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.893:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.895:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.903:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.906:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
:mozilla.908:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.912:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.913:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Masterstats : Cleaned with backup
:mozilla.914:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.919:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.920:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.921:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.922:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.923:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.928:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.933:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.934:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.969:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.970:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.973:C:\Documents and Settings\Mike\Application Data\Mozilla\Firefox\Profiles\default.0ep\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Mike\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Mike\Cookies\[removed][2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Mike\Cookies\mike@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\Documents and Settings\Mike\Cookies\mike@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Mike\Cookies\mike@revenue[2].txt -> Spyware.Cookie.Revenue : Cleaned with backup
C:\Documents and Settings\Mike\Desktop\uninstall6_76.exe -> Spyware.NewDotNet : Cleaned with backup
C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\Content.IE5\7HIJ2LVE\protector[1].exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\Content.IE5\WKOB66X2\dual-uk[2].exe -> TrojanDownloader.Small.bci : Cleaned with backup
C:\Documents and Settings\Mike\Local Settings\Temporary Internet Files\Content.IE5\WKOB66X2\pokapoka63[1].exe -> Spyware.EliteBar : Cleaned with backup
C:\WINNT\cache329\B_329_4_1_797800.htm -> Spyware.BookedSpace : Cleaned with backup
C:\WINNT\etb\nt_hide61.dll -> Spyware.EliteBar : Cleaned with backup
C:\WINNT\etb\nt_hide63.dll -> Spyware.EliteBar : Cleaned with backup
C:\WINNT\etb\pokapoka61.exe -> TrojanDropper.Agent.qz : Cleaned with backup
C:\WINNT\etb\pokapoka63.exe -> Spyware.EliteBar : Cleaned with backup
C:\WINNT\etb\xud2f.dll -> Spyware.EliteBar : Cleaned with backup
C:\WINNT\etb\xud_63.dll -> Spyware.EliteBar : Cleaned with backup
C:\WINNT\NDNuninstall4_85.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINNT\NDNuninstall6_38.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINNT\protector.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINNT\system32\adstartup.exe -> Spyware.Adstart : Cleaned with backup
C:\WINNT\system32\hgaveec.sys -> Trojan.Painwin.a : Cleaned with backup
C:\WINNT\system32\hiinyfe.vxd -> Trojan.Painwin.a : Cleaned with backup
C:\WINNT\system32\hoafeeo.sys -> Trojan.Painwin.a : Cleaned with backup
C:\WINNT\system32\hridefd.vxd -> Trojan.Painwin.a : Cleaned with backup
C:\WINNT\system32\hyluvc.exe -> Spyware.Adstart : Cleaned with backup
C:\WINNT\system32\hyluvf.exe -> Spyware.Adstart : Cleaned with backup
C:\WINNT\system32\modgxyz.exe -> Spyware.Adstart : Cleaned with backup
C:\WINNT\system32\SWin32.dll -> Spyware.Adstart : Cleaned with backup

::Report End

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Hijack Log - plse help

✨ Ask AI

Ask AI