What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

CoolWebWWWSearch.SearchKlick

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Sorry guys and gals, but Spybot has detected a new infection. I have your recommended blockers loaded, but it seems to have got through anyway. CW Shredder does not find it, and it cannot be removed on re-start. Your help please. twosheds
Post #3
Yes, I am afraid it is.

The progs stopped a trojan, but when the next update of SpyBot came out, it registered 2 CWS files - the other was CoolWWWSearch.HomeSearch, which it removed.

I have the blockers you recommended, and I have updated them. I did use IE that time, not Firefox.

I am about to go to bed in 10, so say if we should start again tomorrow.

Thanks

Logfile of HijackThis v1.99.1
Scan saved at 00:36:25, on 11/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Windows NT\Pinball\PINBALL.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\OPScan.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali Internet Access
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /dropdisc
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: TextBridge Instant Access OCR.lnk = C:\Program Files\TextBridge Classic\Bin\TBMENU.EXE
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098471408322
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB24C28D-C69A-413C-BA5D-5A25BDD0B431}: NameServer = 212.74.114.129 212.74.114.193
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #4
You can run this tommorow.
I don't see any bad guys in your log, so we'll see if we can find anything :thumbup:

Please download ewido Security Suite
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu."
  • Launch ewido, there should be a big "E" icon on your desktop, double-click it.
  • The program will prompt you to update click the "OK" button
  • The program will now go to the main screen

    You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Click on Start

    The update will start and a progress bar will show the updates being installed. After the updates are installed, exit ewido.

    Once the updates are installed do the following:
  • If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.
  • Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Then, run ewido.
  • Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!
  • Click on scanner
  • Click on Settings
    • Under "How to scan" all boxes should be selected
    • Under "Possibly unwanted software" all boxes should be selected
    • Under "What to scan" select scan every file
    • Click OK
  • Click on Complete system scan
  • Let the program scan the machine
  • If ewido finds anything, it will pop up a notification. NOTE: We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, AOL, pcAnywhere and the game "Risk" have been flagged. In particular, watch for alerts that have the word "Heuristic" in them - if you recognize the file name as "friendly," these may actually be false positives) select "none" as the action. DO NOT check "Perform action with all infections." If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.

    Once the scan has completed, there will be a button located on the bottom of the screen named Save report.
  • Click Save report
  • Save the report to your desktop
  • Exit ewido

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #7
Hi,

Ewido found around 800 files. I left the scanner page to try and change an action on one file and could not get back to the scan page (which by then had finished) to save the original report. So the scan page following is a repeat after I had re-run it.

Ran SpyBot, I cannot update it as it cannot find the site (error message). It said CoolWWWSearch.SearchKlick still present -BUT, I tried 'fix', and it said it did so successfully!! Re-ran SpyBot, which now says no immediate threats - I did not expect it to be worth trying to fix, really! And as a kicker, it now checks and tells me that no updates are available!!! I shall re-run HJT and add the second log file to the end.




Logfile of HijackThis v1.99.1
Scan saved at 16:33:12, on 11/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\TextBridge Classic\Bin\TBMENU.EXE
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\WINDOWS\system32\wuauclt.exe


C:\Documents and Settings\Neil\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali Internet Access
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /dropdisc
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: TextBridge Instant Access OCR.lnk = C:\Program Files\TextBridge Classic\Bin\TBMENU.EXE
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB24C28D-C69A-413C-BA5D-5A25BDD0B431}: NameServer = 212.74.114.129 212.74.114.193
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



——————————————————–
ewido security suite - Scan report
———————————————————

+ Created on: 16:29:27, 11/09/2005
+ Report-Checksum: F1FEBCB9

+ Scan result:

:mozilla.125:C:\Documents and Settings\Neil\Application Data\Mozilla\Firefox\Profiles\i9c5xeyy.default\cookies.txt -> Spyware.Cookie.Googleadservices : Ignored
C:\Documents and Settings\Neil\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv410.jar-5e82ef8f-606bfbb4.zip/Matrix.class -> TrojanDownloader.Java.OpenStream.c : Ignored
C:\Program Files\ewido\security suite\Quarantine\res2A8.tmp -> TrojanDownloader.Agent.bq : Ignored
C:\Program Files\ewido\security suite\Quarantine\res2A9.tmp -> TrojanDownloader.Agent.bq : Ignored
C:\Program Files\ewido\security suite\Quarantine\res2AA.tmp -> TrojanDownloader.Agent.bq : Ignored
C:\Program Files\ewido\security suite\Quarantine\res2AB.tmp -> TrojanDownloader.Agent.bq : Ignored
C:\Program Files\ewido\security suite\Quarantine\res2AC.tmp -> TrojanDownloader.Agent.bq : Ignored
C:\Program Files\HijackThis\backups\backup-20050824-000016-948.dll -> Dialer.Generic : Ignored
C:\WINDOWS\cdplayer.ini:hkizi -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\clock.avi:fzmuqj -> Trojan.Agent.bi : Ignored
C:\WINDOWS\clock.avi:zodps -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\explorer.scf:iwzjp -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\explorer.scf:lyfbb -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\explorer.scf:ngwjtv -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\explorer.scf:sbuwn -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\explorer.scf:tsfnbo -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\explorer.scf:viqyt -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\FaxSetup.log:chwtg -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\FeatherTexture.bmp:dhvop -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\FeatherTexture.bmp:izzag -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\javacn.exe -> Trojan.Agent.bi : Ignored
C:\WINDOWS\javalz.exe -> Trojan.Agent.bi : Ignored
C:\WINDOWS\javanj.exe -> Trojan.Agent.bi : Ignored
C:\WINDOWS\javaok32.exe -> Trojan.Agent.bi : Ignored
C:\WINDOWS\javatv.exe -> Trojan.Agent.bi : Ignored
C:\WINDOWS\javaxn32.exe -> Trojan.Agent.bi : Ignored
C:\WINDOWS\javaxx.exe -> Trojan.Agent.bi : Ignored
C:\WINDOWS\javayn.exe -> Trojan.Agent.bi : Ignored
C:\WINDOWS\MESH_SKY.BMP:aciqtx -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\MESH_SKY.BMP:uqrrr -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\ModemLog_Softk56 Data Fax Voice Speakerphone CARP.txt:hnubb -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\ModemLog_Softk56 Data Fax Voice Speakerphone CARP.txt:ujzke -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\moffice(2).ini:fapdn -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\moffice(2).ini:kfepy -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\moffice.ini:fapdn -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\moffice.ini:kfepy -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\msdfmap.ini:lqiqd -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\msdfmap.ini:tfsfgn -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\ODBC.INI:ormbz -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\ODBCINST(2).INI:qdzqa -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\OpPrintServer.INI:odvrnw -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\OpPrintServer.INI:xyddj -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\orun32(2).ini:bpupy -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\orun32(2).ini:dyjdj -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\orun32(2).ini:uhiwo -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\orun32(2).isu:ilyjx -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\orun32(2).isu:kpzbl -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\orun32(2).isu:lassh -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\orun32(2).isu:xjuhc -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\orun32.ini:jnzdv -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\orun32.ini:uhiwo -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\orun32.ini:xcwllb -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\orun32.isu:ilyjx -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\orun32.isu:owthgv -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\REGLOCS(2).OLD:akfzy -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\REGLOCS(2).OLD:burip -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\REGLOCS(2).OLD:bxfyx -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\REGLOCS.OLD:burip -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\regopt.log:awmzd -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\tiscali04.ico:otgmdb -> Trojan.Agent.bi : Ignored
C:\WINDOWS\TiscaliHelp04(2).ico:gkzwk -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\TiscaliHelp04(2).ico:kffop -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\TiscaliHelp04(2).ico:yhejj -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\TiscaliHelp04.ico:xtpwx -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\TiscaliHelp04.ico:yhejj -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\TXBRIDGE(2).INI:manjw -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\TXBRIDGE(2).INI:nalmk -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\TXBRIDGE.INI:manjw -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\TXBRIDGE.INI:uewqg -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:abeka -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:abvim -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:aceoxa -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:acsxbr -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:adqmu -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:aidbh -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:aijjk -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:ailwy -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:aiosj -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:alutt -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:aoitq -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:apiuf -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:arpmc -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:axiqu -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:ayiwhd -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:azvxp -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:bcdka -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:bdkwe -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:bessy -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:bfpry -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:bgref -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:bhmbj -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:biacz -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:bidzqx -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:binff -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:blpci -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:blvew -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:bmgyyg -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:bpsqd -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:brfqhx -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:bxhby -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:ccjhuj -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:cedpu -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:chnzs -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:clmtt -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:cnxbag -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:conkf -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:corsd -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:csykw -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:cszdmh -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:cxqrc -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:dafcib -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:dcrxu -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:dfhxo -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:dftol -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:dgulm -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:dimec -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:dkexc -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:dmjvyw -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:dskck -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:dufbp -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:durlt -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:dwlaz -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:eaawla -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:ehwfb -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:ekeze -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:elnfi -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:embssm -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:epkaaa -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:etmfu -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:etnar -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:eupfk -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:eurzo -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:evnby -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:ezqnjt -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:faglwt -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fbkrxn -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fclgh -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:ffyqj -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fgkhk -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:fjkwb -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fkbhj -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:flqhr -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fmsyz -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:frxkcw -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:fsejp -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fsmul -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fsweng -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:ftdpr -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fuasib -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:fuqgd -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fvzxv -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fwifs -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fxotr -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:fzdkh -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:fzpwb -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:gdaeh -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:geunr -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:gfirk -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:giedgz -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:gkxxy -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\~ACROBAT.TMP:gmidmb -> Trojan.Agent.bi : Ignored
C:\WINDOWS\~ACROBAT.TMP:gmijq -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\~ACROBAT.TMP:gowec -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\explorer.scf:pnkci -> TrojanDownloader.Agent.bc : Cleaned with backup


::Report End



Logfile of HijackThis v1.99.1
Scan saved at 16:58:49, on 11/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\TextBridge Classic\Bin\TBMENU.EXE
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\Neil\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali Internet Access
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /dropdisc
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: TextBridge Instant Access OCR.lnk = C:\Program Files\TextBridge Classic\Bin\TBMENU.EXE
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB24C28D-C69A-413C-BA5D-5A25BDD0B431}: NameServer = 212.74.114.129 212.74.114.193
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #8
please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #9
All done, thanks.

Spybot is happy!

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 18:46:02, 11/09/2005
+ Report-Checksum: 6C250774

+ Scan result:

:mozilla.122:C:\Documents and Settings\Neil\Application Data\Mozilla\Firefox\Profiles\i9c5xeyy.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
C:\Documents and Settings\Neil\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv410.jar-5e82ef8f-606bfbb4.zip/Matrix.class -> TrojanDownloader.Java.OpenStream.c : Cleaned with backup
C:\Program Files\ewido\security suite\Quarantine\res2A8.tmp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\Program Files\ewido\security suite\Quarantine\res2A9.tmp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\Program Files\ewido\security suite\Quarantine\res2AA.tmp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\Program Files\ewido\security suite\Quarantine\res2AB.tmp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\Program Files\ewido\security suite\Quarantine\res2AC.tmp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\Program Files\HijackThis\backups\backup-20050824-000016-948.dll -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\cdplayer.ini:hkizi -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\clock.avi:fzmuqj -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\clock.avi:zodps -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\explorer.scf:iwzjp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\explorer.scf:lyfbb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\explorer.scf:ngwjtv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:sbuwn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:tsfnbo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\explorer.scf:viqyt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\FaxSetup.log:chwtg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:dhvop -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\FeatherTexture.bmp:izzag -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\javacn.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javalz.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javanj.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaok32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javatv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaxn32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaxx.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javayn.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\MESH_SKY.BMP:aciqtx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\MESH_SKY.BMP:uqrrr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ModemLog_Softk56 Data Fax Voice Speakerphone CARP.txt:hnubb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ModemLog_Softk56 Data Fax Voice Speakerphone CARP.txt:ujzke -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\moffice(2).ini:fapdn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\moffice(2).ini:kfepy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\moffice.ini:fapdn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\moffice.ini:kfepy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msdfmap.ini:lqiqd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msdfmap.ini:tfsfgn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBC.INI:ormbz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST(2).INI:qdzqa -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\OpPrintServer.INI:odvrnw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\OpPrintServer.INI:xyddj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32(2).ini:bpupy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\orun32(2).ini:dyjdj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32(2).ini:uhiwo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\orun32(2).isu:ilyjx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\orun32(2).isu:kpzbl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32(2).isu:lassh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32(2).isu:xjuhc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32.ini:jnzdv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32.ini:uhiwo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\orun32.ini:xcwllb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\orun32.isu:ilyjx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\orun32.isu:owthgv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\REGLOCS(2).OLD:akfzy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\REGLOCS(2).OLD:burip -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\REGLOCS(2).OLD:bxfyx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\REGLOCS.OLD:burip -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\regopt.log:awmzd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tiscali04.ico:otgmdb -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\TiscaliHelp04(2).ico:gkzwk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TiscaliHelp04(2).ico:kffop -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\TiscaliHelp04(2).ico:yhejj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TiscaliHelp04.ico:xtpwx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TiscaliHelp04.ico:yhejj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TXBRIDGE(2).INI:manjw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\TXBRIDGE(2).INI:nalmk -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\TXBRIDGE.INI:manjw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\TXBRIDGE.INI:uewqg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:abeka -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:abvim -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:aceoxa -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:acsxbr -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:adqmu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:aidbh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:aijjk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:ailwy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:aiosj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:alutt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:aoitq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:apiuf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:arpmc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:axiqu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:ayiwhd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:azvxp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bcdka -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bdkwe -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bessy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bfpry -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bgref -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bhmbj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:biacz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bidzqx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:binff -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:blpci -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:blvew -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bmgyyg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bpsqd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:brfqhx -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:bxhby -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:ccjhuj -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:cedpu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:chnzs -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:clmtt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:cnxbag -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:conkf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:corsd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:csykw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:cszdmh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:cxqrc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dafcib -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dcrxu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dfhxo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dftol -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dgulm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dimec -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dkexc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dmjvyw -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dskck -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dufbp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:durlt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:dwlaz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:eaawla -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:ehwfb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:ekeze -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:elnfi -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:embssm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:epkaaa -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:etmfu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:etnar -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:eupfk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:eurzo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:evnby -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:ezqnjt -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:faglwt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fbkrxn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fclgh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:ffyqj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fgkhk -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fjkwb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fkbhj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:flqhr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fmsyz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:frxkcw -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fsejp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fsmul -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fsweng -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:ftdpr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fuasib -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fuqgd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fvzxv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fwifs -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fxotr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fzdkh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:fzpwb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:gdaeh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:geunr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:gfirk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:giedgz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:gkxxy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:gmidmb -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:gmijq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\~ACROBAT.TMP:gowec -> TrojanDownloader.Agent.bc : Cleaned with backup


::Report End

Logfile of HijackThis v1.99.1
Scan saved at 18:53:54, on 11/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Outlook Express\msimn.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Neil\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali Internet Access
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /dropdisc
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: TextBridge Instant Access OCR.lnk = C:\Program Files\TextBridge Classic\Bin\TBMENU.EXE
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB24C28D-C69A-413C-BA5D-5A25BDD0B431}: NameServer = 80.225.252.50 80.225.252.58
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #10
Good Job :thumbup:


Log looks good :D :thumbup: How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK




If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D
Post #11
Done that, updated all checkers and they say clean. Running OK, but the only indication I had was the Spybot target. Only unusuals are that I have had an error message on shutdown just before end which is headed runtime error and refers to a Symantec file (I think) with SRND in the name. It flashes so fast I seldom get to read it. The only other thing is on start up as desktop finishes loading the system tray, Norton comes up second last and I get a very brief pop up message to say I am not protected as Norton is switched off. This disaappears quickly and Norton is on. Otherwise A OK. I was using Spywareblaster and Spywareguard (both updated) before. I had IESPY AD downloaded but seem to have omitted to install it (I got reading the blurb and then loggged off). Always use firewall and virus protection. Very many thanks twosheds :wavey:
Post #12

I get a very brief pop up message to say I am not protected as Norton is switched off. This disaappears quickly and Norton is on. Otherwise A OK

.
That's normal.

Great job :thumbup:

You're more then welcome.
Glad we were able to help

Peace be with you :wavey:
Post #13
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI