pc illiterate

Hello alge and welcome to the forum. Sorry for the wait, we are very busy If you are still waiting for help and are not being helped elsewhere, I need you to do this:

1) Do your best to tell me what your problems are. What are the symptoms and are you receiving any error messages? (I'll need those "word for word" if you are)

2) Please move HJT from the Desktop. We need to store logs and backups for safety. I suggest C:\HJT\HijackThis.exe. If you need additional instructions, use these:
http://russelltexas.com/malware/createhjtfolder.htm
http://www.bleepingcomputer.com/forums/tutorial94.html

3) Since the logs can change quickly I need to see a new HJT log, once you have moved it. Post it in this same thread. I will respond as soon as possible after you post that log.

Thanks…pskelley
TomCoyote forum
Slyware Warrior

hi, thanks for your time.you are totally right,desktop is not a safe place.i cannot post a hjt log.when i did a scan then went to view the log it appeared momentarily then was replaced by the message " u must love some1 a lot" . i have zone alarm firewall, lavasoft ad-aware and webroot spysweeper.i have just tried a free scan by pc doctor and it said that i have 312 lots of malware on my pc yet my other spyware prog. are not picking them up. i have tried to take hjt off my desktop but dont know how? i followed the instructions on the link you gave me but all i achieved was opening an empty folder.so i tried downloading hjt again into the folder and i had the message that it was a temporary folder and not to keep hjt there. my pc is runnung very slow.i cannot do a system restore.it will not shutdown in the normal manner.i find entering some website impossible.when i run my spy ware scansthey take up to 5 times longer than normal. i have easymessenger on my pc and cant get rid of it.there is some program or folder or something that is keeping this malware because i dont have to connect to the internet for there to be spyware loaded and ad-aware to pick it up. i truly am thankful for your help and hope i have given you some idea as to my problems.i would be very grateful if someone could tell me how to put hjt into a safe place onto my pc. thank you so very much, alge.

Look at the information in the links in item #2 of the instructions. Both links show you how to do this. If you need more help, ask someone with more computer experience to help you. It may help for you to delete all instances of HJT and start over. If you do that, then Open your C drive and point at a blank spot, then RIGHT click your mouse. Click on New then Folder. Name that folder HJT. Now go here: http://www.malwareremoval.com/downloads.html then look here:

2. Also available as a exe download from HijackThis
click on the download I have highlited in red. When the download opens choose to Save as then Save it in the folder you made earlier C:\HJT\HijackThis.exe by navigating to that folder until it is in the save box. Then you will go to the folder on the C:\ and open it, the click on HJT to run it. Then post a new log in this same thread. This information is in those links, good luck…pskelley

OK alge, thank you for the new log, you positioned HJT perfectly I have a minor problem, my scanners are down and I have to do things manually. A look at your log shows some adware, but nothing that should be causing the problems you mentioned. I am going to ask you to run some scans to see if we can locate the source of the problem (HJT can not see everything) but first I want you to check with your ISP and make sure this information is valid for them: NameServer = 62.6.40.162 194.72.0.98. Make sure you let me know what they had to say. This should be your ISP: http://www.btopenworld.com/togetherinternet

Now to the scans, do these in order and carefully follow the directions and you will have no problems. All scans are free and safe if the directions are followed, thanks.

1) Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions http://www.ccleaner.com/help/tour1.asp and please do not run it until I ask you to.

2) Download, update, configure and run these two programs: http://tomcoyote.org/aawsb.php
The newest version of Ad-aware is 1.06 and Spybot 1.04. Even if you have these programs, use the link to get the newest version, update and configure them as in the link. Run Spybot first, reboot then run Ad-aware. Both programs back up what they remove so delete anything the programs say should be removed.

3) Ewido scan:
Please download Ewido Security Suite it is a trial version of the program.

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.**
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop.

Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")

4) Run CCleaner, Windows & Applications when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do. Then restart the computer and post a new HJT log and the Ewido scan results in this same thread along with any feedback you have. Let me know how your computer is running now and don't forget to post the information from your ISP.

Thanks…pskelley
TomCoyote forum
Slyware Warrior

i have done what you advised except for the cc cleaner scan.the ewido scan found 85 items of spyware.mysearch and wild tangent were 2.my pc is running as it was now. thank you very much for your time and effort its much appreciated. im still waiting for a reply from bt on the name server thing.if you think its necessary ill complete the rest of your advice when ive got it.i think that its sorted now but ill heed your advice. thanks once again, you guys are great

Hi alge, The CCleaner scan is important as it is going to find and remove junk that is not malware so Ewido would not concern itself with it. You will be surprised at the space CCleaner will open up for you. Clean under Windows, then Applications. Then do Issues (regcleaner) When it finds junk in the registry it will give you the list. Check the boxes and then you will be asked to backup the registry, do so. Anytime you do anything in the registry always back it up. Then post the Ewido scan results and a new HJT log that was run AFTER Ewido and CCleaner were run. It ain't over till it's over we want a clean machine. Then I have some information to help you keep it clean. The info from the ISP is important, I want to make sure that is valid and not bad stuff. You should be able to call a toll free number and ask for tech support. The tech people will be able to tell you in a minute.

Cheers…Phil

Maybe this information will help?
https://www.bt.com/feedback/feedback.jsp?fo…actus_phonelist

1. What is your primary BT Yahoo! Broadband username? 2. What area of the BT Yahoo! Broadband service does the issue relate to (e.g. Online Portal, Broadband Connection, Email Issue or General Enquiry)? 3. What Operating System are you using (e.g. Windows 98SE, Windows XP, MacOS X 10.2)? 4. What browser are you using and what version (e.g. Internet Explorer 6 SP1, Netscape 7.1)? 5. What mail client are you using and which version (e.g. Outlook Express 5.5, Webmail)? 6. Do you use Antivirus, Firewall, Privacy or Parental Control software? If so, which ones? 7. Which modem/router do you use to access the BT Yahoo! Broadband service (e.g. Speedtouch 330, Voyager 205)? 8. What error message are you currently receiving? 9. What is the exact issue you are experiencing, including any information regarding exactly what happens when you try to use the relevant service. Also, include any unusual behaviour or any error messages that you feel may be relevant? this is the reply from bt when i asked them to verify the name server. i told you i was hopeless.sorry i cant seem to copy and paste the ewido log.

Hi alge…first let's get that log from Ewido, it will show me areas I can't see with HJT and I want to make sure you did not miss any bad stuff. I will assume you allowed Ewido to install to the default location which is C:\Program Files\ What I want you to do is RIGHT click on Start, then click on Explore. In the list to the left, which is alphabetical, scroll until you see Program Files. Click the plus sign in front of Program Files. Now scroll down to ewido and click the plus sign in front of it. Do the same for Security Suite. Now click once on Reports. If you only ran the scan once there will be only one Scan report there in a Text Document. Click once or twice until it opens in the Notepad. On the top line click on Edit, then Select All. The information will highlite, point the mouse at the information and RIGHT click then choose COPY. Now with the information on your clipboard, place that information in this post just the way you do your HJT log. RIGHT click and PASTE. Thanks.

Now we will use HJT to remove some adware and others bad stuff.

Best to do this offline because we need to turn off SpySweeper as it may block the HJT fix:
Open the program
Select: Options (on the left)
Select: Program Options
Uncheck: Load at windows startup
On the left, click: Shields, and uncheck all there items
Uncheck: Home Page Shield
Uncheck: Automatically restore default without notification

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab

Close all programs but HJT and all browser windows, then click on "Fix Checked"

C:\Windows\Prefetch: Locate this folder and delete all of the contents (NOT THE FOLDER) This information will tell you more about Prefetch:
http://www.windowsnetworking.com/articles_…refetch-XP.html

Empty your recycle bin and restart the computer. Post a last HJT log along with the Ewido scan report, ta.

Here is some information about a resource waster you have running:
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
http://www.bleepingcomputer.com/startups/C…K.EXE-4042.html
http://www.liutilities.com/products/wintas…brary/calcheck/
This information will show you how to turn it off: http://netsquirrel.com/msconfig/

Thanks…Phil (with a little luck, this will be the last of it…Cheers
Do let me know how things are running now…Ta

hi phil, thanks for the info. heres my ewido log.——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 02:03:40, 29/09/2005 + Report-Checksum: A2116E9E + Scan result: C:\Documents and Settings\alge\Cookies\[removed][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP242\A0134184.exe -> Worm.Apsiv : Cleaned with backup ::Report End

Thanks but you ran that one today I wanted the log from the first one you ran two days ago. Just post a HJT log so I can make sure you are clean.

ooops sorry, here you g——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 23:52:08, 27/09/2005 + Report-Checksum: 3315E062 + Scan result: HKU\S-1-5-21-436374069-2111687655-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} -> Spyware.MyWebSearch : Cleaned with backup HKU\S-1-5-21-436374069-2111687655-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{014DA6C1-189F-421A-88CD-07CFE51CFF10} -> Spyware.eXact : Cleaned with backup HKU\S-1-5-21-436374069-2111687655-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{014DA6C9-189F-421A-88CD-07CFE51CFF10} -> Spyware.MySearch : Cleaned with backup HKU\S-1-5-21-436374069-2111687655-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup HKU\S-1-5-21-436374069-2111687655-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{36A59337-6EEF-40AE-94B1-ED443A0C4740} -> Spyware.BetterInternet : Cleaned with backup HKU\S-1-5-21-436374069-2111687655-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Spyware.NewDotNet : Cleaned with backup HKU\S-1-5-21-436374069-2111687655-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{86227D9C-0EFE-4F8A-AA55-30386A3F5686} -> Spyware.YourSiteBar : Cleaned with backup HKU\S-1-5-21-436374069-2111687655-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{999A06FF-10EF-4A29-8640-69E99882C26B} -> Spyware.Begin2Search : Cleaned with backup C:\WINDOWS\system32\__sys.exe -> Worm.Apsiv : Cleaned with backup C:\WINDOWS\Temp\CSF90E3382-98D1-4B10-BFB6-9469F04862E5.tmp -> Heuristic.Win32.AVKiller : Cleaned with backup C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup C:\Documents and Settings\alge\Cookies\[removed][1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup C:\Documents and Settings\alge\Cookies\alge@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP134\A0060307.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP134\A0060309.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP134\A0060313.DLL -> Spyware.MySearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP182\A0097065.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP182\A0097066.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP182\A0097069.exe -> Spyware.NewDotNet : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP182\A0097073.DLL -> Spyware.MySearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP185\A0101233.dll -> Spyware.WildTangent : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101398.scr -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101401.DLL -> Spyware.FunWeb : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101402.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101403.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101404.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101405.SCR -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101406.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101407.EXE -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101408.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101409.DLL -> Spyware.Wesbar : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101410.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101411.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101412.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101413.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101414.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101415.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101439.dll -> Spyware.WildTangent : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101457.dll -> Spyware.WildTangent : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101472.dll -> Spyware.WildTangent : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101482.dll -> Spyware.WildTangent : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101555.EXE -> Spyware.Wesbar : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101556.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101557.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101558.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101559.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP187\A0101566.dll -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101578.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101581.dll -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101582.scr -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101583.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101584.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101585.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101586.DLL -> Spyware.FunWeb : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101587.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101588.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101589.SCR -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101590.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101591.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101592.EXE -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101593.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101594.DLL -> Spyware.Wesbar : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101595.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101596.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101597.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101598.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101599.exe -> Spyware.Wesbar : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101601.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0101602.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0102555.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0102556.EXE -> Spyware.Wesbar : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0102557.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0102558.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP188\A0102559.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP189\A0102569.dll -> Spyware.MyWebSearch : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129030.exe -> Spyware.Beginto.c : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129040.dll -> Spyware.Beginto : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129041.dll -> Spyware.Beginto : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129042.dll -> Spyware.Beginto : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129043.dll -> Spyware.Beginto : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129044.dll -> Spyware.Beginto : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129045.dll -> Spyware.Beginto : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129046.dll -> Spyware.Beginto : Cleaned with backup C:\System Volume Information\_restore{90C7F32B-A071-42E0-9AE9-4B670EC68B76}\RP233\A0129047.dll -> Spyware.Beginto : Cleaned with backup C:\My Shared Folder\SSF11D.tmp -> Worm.Apsiv : Cleaned with backup ::Report Endo.

heres the ewido scan i ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 05:55:53, 30/09/2005 + Report-Checksum: 17BF215E + Scan result: No infected objects found. ::Report Endjust did