What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Instant Messenger Virus

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Shelf life, below is my most recent HJT log

Logfile of HijackThis v1.99.1
Scan saved at 12:54:52 AM, on 10/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Roxio\GoBack\GBPoll.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InfoMyCa.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Roxio\GoBack\GBTray.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Windows\services32.exe
C:\Documents and Settings\Administrator\Desktop\Alan\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weather.com/weather/local/29401…LocalUndeclared
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [WUSB54Gv4] C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [freestyle] lockx.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Arcsoft Web Uploader - http://www.hpphoto.com/downloads/ReadFileApplet.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WUSB54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv4.exe (file missing)
Post #2
I did not find any of the files you mentioned here http://forums.tomcoyote.org/index.php?show…18&#entry220018

What I did find was a similar lockx.exe in prefetch which I took the liberty of deleting.

I also took the liberty of removing lockx.exe with Hijack THis but as you can see it recreated itself. I also removed any entries that I noticed relating to "freeprod"

I opened task manager and did not find anything relating to img52.exe. What I did find were a number of entries with several letters then 32.exe. Based on what I read at symantec http://securityresponse.symantec.com/avcen…n.elitebar.html I ended the task on these processes. There were about four or five mixed between my user and system. No instability resulted.

Now in System32 I did find the following files which I think are related to this bug. mc-62-602-0000156 and mc-58-12-0000166. Both are applications.

I did go to %temp% and deleted most everything I could. I am afraid that some of the files left are used by this virus.

I am sure there are progeny from this thing seeded all over.
Post #3
hi Chasmed, before you start please temporaily disable Spybots tea timer option as it may prevent the "fix" sorry for thr delay. log dosnt look to bad, run hjt and have it "fix" this item O4 - HKCU\..\Run: [freestyle] lockx.exe ———————————- next bring up task manager by hitting ctrl-alt-delete, end task on service32.exe if running. next delete this file >>services32.exe located here>>Program Files\Common Files\Windows and delete both those .exe you found in the sytem32 directory mc-62-602-0000156 and mc-58-12-0000166. then do search on your computer for the lockx.exe and delete it. afterwards, reboot computer once and rescan and post a new hjt log. shelf life
Post #5
Logfile of HijackThis v1.99.1
Scan saved at 11:01:47 PM, on 10/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Roxio\GoBack\GBPoll.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InfoMyCa.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Roxio\GoBack\GBTray.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\Documents and Settings\Administrator\Desktop\Alan\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weather.com/weather/local/29401…LocalUndeclared
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [WUSB54Gv4] C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Arcsoft Web Uploader - http://www.hpphoto.com/downloads/ReadFileApplet.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WUSB54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv4.exe (file missing)
Post #6
Below is a little Norton History for you if it helps. Threat category: VirusSource: C:\xz.bat,Description: The file C:\xz.bat is infected with the Trojan Horse virus. Threat category: AdwareSource: C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll,Description: The file C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll is a Adware threat. Threat category: VirusSource: C:\Program Files\Common Files\Windows\mc-62-602-0000156.exe,Description: The file C:\Program Files\Common Files\Windows\mc-62-602-0000156.exe is infected with the Trojan.Dropper virus. Threat category: VirusSource: C:\Program Files\Common Files\Windows\mc-58-12-0000166.exe,Description: The file C:\Program Files\Common Files\Windows\mc-58-12-0000166.exe is infected with the Trojan.Dropper virus. Threat category: VirusSource: C:\Program Files\Common Files\InetGet2\mc-62-602-0000156.exe,Description: The file C:\Program Files\Common Files\InetGet2\mc-62-602-0000156.exe is infected with the Trojan Horse virus. Threat category: VirusSource: C:\Program Files\Common Files\InetGet2\mc-58-12-0000166.exe,Description: The file C:\Program Files\Common Files\InetGet2\mc-58-12-0000166.exe is infected with the Trojan Horse virus. Threat category: AdwareSource: C:\Program Files\Common Files\Download\mc-58-12-0000166.exe,Description: The file C:\Program Files\Common Files\Download\mc-58-12-0000166.exe is a Adware threat. Threat category: VirusSource: C:\Program Files\Common Files\InetGet\mc-58-12-0000166.exe,Description: The file C:\Program Files\Common Files\InetGet\mc-58-12-0000166.exe is infected with the Trojan.Dropper virus. Threat category: VirusSource: C:\Program Files\Common Files\InetGet\mc-62-602-0000156.exe,Description: The file C:\Program Files\Common Files\InetGet\mc-62-602-0000156.exe is infected with the Trojan.Dropper virus. Threat category: AdwareSource: C:\Program Files\Common Files\Download\mc-62-602-0000156.exe,Description: The file C:\Program Files\Common Files\Download\mc-62-602-0000156.exe is a Adware threat. Threat category: AdwareSource: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QD2HMH6R\launcher[1].exe,Description: The file C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QD2HMH6R\launcher[1].exe is a Adware threat. Threat category: VirusSource: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CB0D8XG7\dnscatcher[1].exe,Description: The file C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CB0D8XG7\dnscatcher[1].exe is infected with the Trojan Horse virus. Threat category: VirusSource: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXKRUL6X\director_install[1].exe,Description: The file C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXKRUL6X\director_install[1].exe is infected with the Trojan.Dropper virus. Source: C:\Program Files\Common Files\Windows\services32.exe Source: C:\Program Files\Common Files\Windows\services32.exe Source: C:\WINDOWS\system32\silent_jocker.exe Source: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\H8CBHXST\silent_jocker[1].exe Source: C:\WINDOWS\system32\silent_jocker.exe Source: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4TANOPY7\silent_jocker[1].exe Source: C:\XZ.BAT Source: C:\XZ.BAT Source: C:\xz.bat Source: C:\xz.bat Source: C:\WINDOWS\system32\msdirectx.sys Source: C:\WINDOWS\system32\msdirectx.sys Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\GetAccess.class-4a318e62-316b683e.class Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\InsecureClassLoader.class-38ec64f7-2174dfe9.class Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-73ac7130-627f269b.class Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-7fb5dbb4-1726a7f7.class Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\GetAccess.class-4a318e62-38cf5b34.class Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-d73f6a9-4e0173c0.zip Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\VerifierBug.class-57601442-3fda0b07.class Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-645f4c2c-6060c344.class Source: C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-7fb5dbb4-2b5fca84.class Source: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXKRUL6X\ass[2].htm Source: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXKRUL6X\ass[2].htm Source: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXKRUL6X\ass[1].htm Source: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXKRUL6X\ass[1].htm
Post #7 last edited
hi Chasmed.

yes the Norton history is helpful. did norton av delete these items?

you might want to do a online scan or two at one of these:
MicroWorld

Bitdefender

Norton

Panda Activescan

TrendMicro
——————————
also go to one of two of these:

http://online.drweb.com/
http://www.gietl.com/test-clamav/
http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/xhtml/index_en.html


and then browse for and upload this file:
devldr32.exe
located here:
C:\WINDOWS\system32\
——————————–
some optional fixes you can have hjt fix if you want to, they are not malware

start HJT, click on "none of the above, just start the program" next click the "Scan" button. Check these items, then close all windows and click "Fix Checked"

O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
Post #8
Sorry for the more than overdue response. I have been really busy and just have not felt like getting involved in computer headaches for a while. I think? norton took care of the files in question. The thing is, when Norton ran and caught the files I told it to repair. some it tried to repair and could not. Then it eventually "quarantened" the files. I did not see them in their origional location. I then did something to the effect of sending or reporting them to Symantec. As for the file you said to "upload", what exactly did you mean by that? Click it and run it?
Post #9
BitDefender Online Scanner - Real Time Virus Report Generated at: Fri, Nov 04, 2005 - 15:24:22 ——————————————————————————– Scan Info Scanned Files 188114 Infected Files 30 Virus Detected Trojan.Java.Classloader.Dummy.A 3 Java.Trojan.Exploit.Bytverify 7 Trojan.Downloader.CZR 2 Backdoor.Aimbot.AO 1 Exploit.Phel.Gen 4 Exploit.VBS.Phel.A 2 Trojan.Exploit.Java.Bytverify 1 Adware.Wheaterbug.A 2 Trojan.Dropper.Small.YN 4 Trojan.Exploit.Vbs.Phel.A 1 Java.Trojan.ClassLoader.K 2 Trojan.Java.ClassLoader.D 1
Post #10
hi Chasmed,

things looking any better on that end? its been awhile.

As for the file you said to "upload", what exactly did you mean by that? Click it and run it?

i meant go to one or two of the websites listed:

http://online.drweb.com/
http://www.gietl.com/test-clamav/
http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/xhtml/index_en.html

then using the browse button at the website find this file on your computer:
devldr32.exe
located here:
C:\WINDOWS\system32\
next click the upload button to have the file uploaded to one of these websites, they will check it out and post a report. if you havent done it dont worry about it.
————————————–
try this instead:
Download Ewido Trojan’s and malware remover http://www.ewido.net/en/download/
This setup contains the free as well as the plus-version of the ewido security suite. After the installation, a free 14-day test version containing all the extensions of the plus-version will be activated. At the end of the test phase, the extensions of the plus version are deactivated and the freeware version can be used unlimited times. The purchased license code of the plus version can be entered at any time.
Ewido will auto-udate. Don't run yet
——————————————
* Install ewido security suite
* Launch ewido, there should be an icon on your desktop double-click it.
* The program will now go to the main screen

You will need to update ewido to the latest definition files.

* On the left hand side of the main screen click update
* Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:

* Click on scanner
* Click on Complete System Scan and the scan will begin.
* NOTE: During some scans with ewido it is finding cases of false positives.**
o You will need to step through the process of cleaning files one-by-one.
o If ewido detects a file you KNOW to be legitimate, select none as the action.
o DO NOT select "Perform action on all infections"
o If you are unsure of any entry found select none for now.
* Once the scan has completed, there will be a button located on the bottom of the screen named Save report
* Click Save report.
* Save the report .txt file to your desktop.
—————————————-
shelf life
Post #11
I am deliquent (SP?). I am currently running Ewido. In the process I was going though my Add/Remove Programs list and noticed that that dern "freeprod toolbar" regenerated itself. I am also running ad-aware. I will post my results shortly
Post #12
Trend Micro House call found nothing.

Ad-aware found nothing

Ewido scan 1:
__________________________________________________
ewido security suite online scanner
http://www.ewido.net
__________________________________________________


Name: Spyware.Cookie.2o7
Path: C:\Documents and Settings\Administrator\Cookies\hendersonja@2o7[1].txt
Risk: Medium

Name: Spyware.Cookie.Yieldmanager
Path: C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Pointroll
Path: C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.Cookie.Bluestreak
Path: C:\Documents and Settings\Administrator\Cookies\hendersonja@bluestreak[1].txt
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\Documents and Settings\Administrator\Cookies\hendersonja@edge.ru4[1].txt
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\Documents and Settings\Administrator\Cookies\hendersonja@msnportal.112.2o7[1].txt
Risk: Medium

Name: Spyware.Cookie.Questionmarket
Path: C:\Documents and Settings\Administrator\Cookies\hendersonja@questionmarket[1].txt
Risk: Medium

Name: Spyware.Cookie.Burstbeacon
Path: C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
Risk: Medium

Name: Spyware.Cookie.Burstnet
Path: C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
Risk: Medium

Name: Spyware.MiniBug
Path: HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
Risk: High

Name: Spyware.KeenValue
Path: HKLM\SOFTWARE\PerfectNav
Risk: High

Name: Dialer.Generic
Path: HKLM\SOFTWARE\Pinfo
Risk: High

Name: Dialer.Generic
Path: HKLM\SOFTWARE\Pinfo\Dialers
Risk: High

Name: Spyware.Delfin
Path: HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\DelFin
Risk: High

Name: Spyware.Delfin
Path: HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\DelFin\PromulGate
Risk: High

Name: Dialer.Generic
Path: HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo
Risk: High

Name: Dialer.Generic
Path: HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo\Dialers
Risk: High

Name: Dialer.Generic
Path: HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo\Dialers\Lisa
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\IESkins
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\HostOI
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\HostOI\dynamic
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\HostOL
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\HostOL\dynamic
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\Hotbar
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\Hotbar\dynamic
Risk: High

Name: Spyware.HotBar
Path: C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\Hotbar\static
Risk: High

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00095543.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095547.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095548.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00095549.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095554.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095555.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095556.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095573.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095574.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095575.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00095582.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00095583.TXT
Risk: Medium

Name: Spyware.Cookie.X10
Path: C:\RECYCLER\NPROTECT\00095584.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095590.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095591.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095592.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095703.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00095704.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095715.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00095716.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095717.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095722.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095723.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095724.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095728.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095729.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095730.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095732.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00095733.TXT
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: C:\RECYCLER\NPROTECT\00095734.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095739.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095740.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095745.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095746.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095747.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095763.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00095764.TXT
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: C:\RECYCLER\NPROTECT\00095765.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095784.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00095785.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095786.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095790.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095791.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095792.TXT
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\RECYCLER\NPROTECT\00095813.TXT
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\RECYCLER\NPROTECT\00095816.TXT
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\RECYCLER\NPROTECT\00095818.TXT
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\RECYCLER\NPROTECT\00095823.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095831.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095832.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095833.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095834.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095835.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095836.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095837.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095838.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095839.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095840.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095841.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095842.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095843.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095844.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00095905.TXT
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\RECYCLER\NPROTECT\00095907.TXT
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\RECYCLER\NPROTECT\00095910.TXT
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: C:\RECYCLER\NPROTECT\00095911.TXT
Risk: Medium

Name: Spyware.Cookie.Sextracker
Path: C:\RECYCLER\NPROTECT\00095914.TXT
Risk: Medium

Name: Spyware.Cookie.Clickzs
Path: C:\RECYCLER\NPROTECT\00095921.TXT
Risk: Medium

Name: Spyware.Cookie.Valuead
Path: C:\RECYCLER\NPROTECT\00095924.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00095932.TXT
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: C:\RECYCLER\NPROTECT\00095933.TXT
Risk: Medium

Name: Spyware.Cookie.X10
Path: C:\RECYCLER\NPROTECT\00095939.TXT
Risk: Medium

Name: Spyware.Cookie.Atdmt
Path: C:\RECYCLER\NPROTECT\00095940.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095946.TXT
Risk: Medium

Name: Spyware.Cookie.Xxxtoolbar
Path: C:\RECYCLER\NPROTECT\00095949.TXT
Risk: Medium

Name: Spyware.Cookie.Adserver
Path: C:\RECYCLER\NPROTECT\00095950.TXT
Risk: Medium

Name: Spyware.Cookie.Paycounter
Path: C:\RECYCLER\NPROTECT\00095951.TXT
Risk: Medium

Name: Spyware.Cookie.Mediaplex
Path: C:\RECYCLER\NPROTECT\00095952.TXT
Risk: Medium

Name: Spyware.Cookie.Spylog
Path: C:\RECYCLER\NPROTECT\00095953.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00095955.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00095956.TXT
Risk: Medium

Name: Spyware.Cookie.Serving-sys
Path: C:\RECYCLER\NPROTECT\00095957.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00096128.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00096129.TXT
Risk: Medium

Name: Spyware.Cookie.X10
Path: C:\RECYCLER\NPROTECT\00096130.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096184.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096281.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096282.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096283.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096405.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096406.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096407.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096409.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096410.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096411.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096421.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096422.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096423.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096426.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096427.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096428.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096433.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096434.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096435.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096450.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00096451.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00096457.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096461.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00096462.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096467.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096468.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096469.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096484.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096485.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00096486.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096490.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00096491.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096510.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096511.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096512.TXT
Risk: Medium

Name: Spyware.Cookie.Atdmt
Path: C:\RECYCLER\NPROTECT\00096526.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096529.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096530.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096533.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096534.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096536.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096538.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096540.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096541.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096543.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096545.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096548.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00096552.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00096562.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096867.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096868.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00096869.TXT
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\RECYCLER\NPROTECT\00096995.TXT
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\RECYCLER\NPROTECT\00096996.TXT
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\RECYCLER\NPROTECT\00096997.TXT
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\RECYCLER\NPROTECT\00096998.TXT
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\RECYCLER\NPROTECT\00096999.TXT
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\RECYCLER\NPROTECT\00097000.TXT
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\RECYCLER\NPROTECT\00097001.TXT
Risk: Medium

Name: Spyware.Cookie.X10
Path: C:\RECYCLER\NPROTECT\00097055.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097069.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097070.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097071.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00097075.TXT
Risk: Medium

Name: Spyware.Cookie.Bluestreak
Path: C:\RECYCLER\NPROTECT\00097080.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00097089.TXT
Risk: Medium

Name: Spyware.Cookie.Specificpop
Path: C:\RECYCLER\NPROTECT\00097098.TXT
Risk: Medium

Name: Spyware.Cookie.X10
Path: C:\RECYCLER\NPROTECT\00097099.TXT
Risk: Medium

Name: Spyware.Cookie.Atdmt
Path: C:\RECYCLER\NPROTECT\00097100.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097105.TXT
Risk: Medium

Name: Spyware.Cookie.Mediaplex
Path: C:\RECYCLER\NPROTECT\00097107.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097113.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00097114.TXT
Risk: Medium

Name: Spyware.Cookie.Trafficmp
Path: C:\RECYCLER\NPROTECT\00097121.TXT
Risk: Medium

Name: Spyware.Cookie.Atdmt
Path: C:\RECYCLER\NPROTECT\00097130.TXT
Risk: Medium

Name: Spyware.Cookie.Atdmt
Path: C:\RECYCLER\NPROTECT\00097132.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00097146.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00097149.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00097150.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00097153.TXT
Risk: Medium

Name: Spyware.Cookie.2o7
Path: C:\RECYCLER\NPROTECT\00097157.TXT
Risk: Medium

Name: Spyware.Cookie.Ru4
Path: C:\RECYCLER\NPROTECT\00097158.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00097159.TXT
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: C:\RECYCLER\NPROTECT\00097160.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097164.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097165.TXT
Risk: Medium

Name: Spyware.Cookie.X10
Path: C:\RECYCLER\NPROTECT\00097170.TXT
Risk: Medium

Name: Spyware.Cookie.Coremetrics
Path: C:\RECYCLER\NPROTECT\00097207.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097276.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097277.TXT
Risk: Medium

Name: Spyware.Cookie.Hitbox
Path: C:\RECYCLER\NPROTECT\00097278.TXT
Risk: Medium

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall4_50.exe
Risk: High

Name: Spyware.NewDotNet
Path: C:\WINDOWS\NDNuninstall4_80.exe
Risk: High



Ewido scan 2
———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 7:21:30 AM, 11/30/2005
+ Report-Checksum: E31CB4B4

+ Scan result:

HKLM\SOFTWARE\Pinfo -> Dialer.Generic : Ignored
HKLM\SOFTWARE\Pinfo\Dialers -> Dialer.Generic : Ignored
HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo -> Dialer.Generic : Ignored
HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo\Dialers -> Dialer.Generic : Ignored
HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo\Dialers\Lisa -> Dialer.Generic : Ignored
C:\WINDOWS\NDNuninstall4_80.exe -> Spyware.NewDotNet : Ignored
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B65AD801-ABAF-11D0-BB8B-00A0C90F2744}\TypeLib\\ -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/piiapzvp.dll\\.Owner -> Spyware.SearchBarCash : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/piiapzvp.dll\\{C64C9CBD-8F82-4E77-0EF3-A2BFF63F6C1C} -> Spyware.SearchBarCash : Cleaned with backup
HKLM\SOFTWARE\PerfectNav -> Spyware.KeenValue : Cleaned with backup
HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\DelFin -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\DelFin\PromulGate -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{B195B3B3-8A05-11D3-97A4-0004ACA6948E} -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\hendersonja@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\hendersonja@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\hendersonja@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\hendersonja@msnportal.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\hendersonja@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\IESkins -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0 -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\HostOI -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\HostOI\dynamic -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\HostOL -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\HostOL\dynamic -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\Hotbar -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\Hotbar\dynamic -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\HendersonJA\Application Data\Hotbar\v3.0\Hotbar\static -> Spyware.HotBar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095543.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095547.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095548.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095549.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095554.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095555.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095556.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095573.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095574.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095575.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095582.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00095583.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00095584.TXT -> Spyware.Cookie.X10 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095590.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095591.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095592.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095703.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095704.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095715.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095716.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095717.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095722.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095723.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095724.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095728.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095729.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095730.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095732.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095733.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095734.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\NPROTECT\00095739.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095740.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095745.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095746.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095747.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095763.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095764.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095765.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\NPROTECT\00095784.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095785.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095786.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095790.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095791.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095792.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095813.TXT -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\RECYCLER\NPROTECT\00095816.TXT -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\RECYCLER\NPROTECT\00095818.TXT -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\RECYCLER\NPROTECT\00095823.TXT -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\RECYCLER\NPROTECT\00095831.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095832.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095833.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095834.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095835.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095836.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095837.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095838.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095839.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095840.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095841.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095842.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095843.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095844.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095905.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00095907.TXT -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\RECYCLER\NPROTECT\00095910.TXT -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\RECYCLER\NPROTECT\00095911.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\NPROTECT\00095914.TXT -> Spyware.Cookie.Sextracker : Cleaned with backup
C:\RECYCLER\NPROTECT\00095921.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\RECYCLER\NPROTECT\00095924.TXT -> Spyware.Cookie.Valuead : Cleaned with backup
C:\RECYCLER\NPROTECT\00095932.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095933.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\NPROTECT\00095939.TXT -> Spyware.Cookie.X10 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095940.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\RECYCLER\NPROTECT\00095946.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095949.TXT -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\RECYCLER\NPROTECT\00095950.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
C:\RECYCLER\NPROTECT\00095951.TXT -> Spyware.Cookie.Paycounter : Cleaned with backup
C:\RECYCLER\NPROTECT\00095952.TXT -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\RECYCLER\NPROTECT\00095953.TXT -> Spyware.Cookie.Spylog : Cleaned with backup
C:\RECYCLER\NPROTECT\00095955.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00095956.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00095957.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\RECYCLER\NPROTECT\00096128.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00096129.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00096130.TXT -> Spyware.Cookie.X10 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096184.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096281.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096282.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096283.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096405.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096406.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096407.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096409.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096410.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096411.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096421.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096422.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096423.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096426.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096427.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096428.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096433.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096434.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096435.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096450.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096451.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096457.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096461.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096462.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096467.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096468.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096469.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096484.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096485.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096486.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096490.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096491.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096510.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096511.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096512.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096526.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\RECYCLER\NPROTECT\00096529.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096530.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096533.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096534.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096536.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096538.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096540.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096541.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096543.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096545.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096548.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096552.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096562.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00096867.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096868.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096869.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00096995.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00096996.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00096997.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00096998.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00096999.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00097000.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00097001.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00097055.TXT -> Spyware.Cookie.X10 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097069.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097070.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097071.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097075.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00097080.TXT -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\RECYCLER\NPROTECT\00097089.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097098.TXT -> Spyware.Cookie.Specificpop : Cleaned with backup
C:\RECYCLER\NPROTECT\00097099.TXT -> Spyware.Cookie.X10 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097100.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\RECYCLER\NPROTECT\00097105.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097107.TXT -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\RECYCLER\NPROTECT\00097113.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097114.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097121.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00097130.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\RECYCLER\NPROTECT\00097132.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\RECYCLER\NPROTECT\00097146.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00097149.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097150.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097153.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097157.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097158.TXT -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097159.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00097160.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\NPROTECT\00097164.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097165.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097170.TXT -> Spyware.Cookie.X10 : Cleaned with backup
C:\RECYCLER\NPROTECT\00097207.TXT -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\RECYCLER\NPROTECT\00097276.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097277.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00097278.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\WINDOWS\NDNuninstall4_50.exe -> Spyware.NewDotNet : Cleaned with backup


::Report End
Post #14
Everything seems to be okay…. BUT I did not delete some of the C:\Recycler\NProtect entries. Are these norton antivirus associated? Should I run ewido again and delete them. Also I accidently told it to fix C:\WindowsNDUninstall4_50.exe. Is that a problem? Should I open the backup and restore the file? (there was another one that I did not tell it to fix) That "freeprod" toolbar is still in my "add/Remove programs" list. Should I simply remove the toolbar? (This I think was installed by the original virus.)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI