Programs (esp. email) open slow. Computer sluggish

My XP has begun acting funning the last few days. This seems to have happened after I loaded a program to listen to streaming radio and a free program to record the stream (my mistake, I know).

My log file is below, if there are any other questions I can answer I will. Thanks for the assistance.

Logfile of HijackThis v1.99.1
Scan saved at 8:42:35 PM, on 24/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Documents and Settings\Jim Stang\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =

Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName

=
N3 - Netscape 7: user_pref("browser.startup.homepage",

"http://home.netscape.com/bookmark/7_2/home.html"); (C:\Documents and

Settings\Jim Stang\Application

Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine",

"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%

5CSBWeb_01.src"); (C:\Documents and Settings\Jim Stang\Application

Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
O1 - Hosts: 213.219.251.78 www.google.com
O1 - Hosts: 213.219.251.78 google.com
O1 - Hosts: 213.219.251.78 www.google.co.uk
O1 - Hosts: 213.219.251.78 google.co.uk
O1 - Hosts: 213.219.251.78 www.google.ca
O1 - Hosts: 213.219.251.78 google.ca
O1 - Hosts: 213.219.251.78 www.google.es
O1 - Hosts: 213.219.251.78 google.es
O1 - Hosts: 213.219.251.78 www.google.de
O1 - Hosts: 213.219.251.78 google.de
O1 - Hosts: 213.219.251.78 www.google.fr
O1 - Hosts: 213.219.251.78 google.fr
O1 - Hosts: 213.219.251.78 www.google.com.au
O1 - Hosts: 213.219.251.78 google.com.au
O1 - Hosts: 213.219.251.79 www.yahoo.com
O1 - Hosts: 213.219.251.79 yahoo.com
O1 - Hosts: 66.218.75.184 mail.yahoo.com
O1 - Hosts: 213.219.251.80 www.msn.com
O1 - Hosts: 213.219.251.80 msn.com
O1 - Hosts: 213.219.251.80 search.msn.com
O1 - Hosts: 213.219.251.80 www.search.msn.com
O1 - Hosts: 213.219.251.80 go.com
O1 - Hosts: 213.219.251.80 www.go.com
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} -

C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

- C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: AzEntretien Class - {0d2def3a-f4f1-42ec-ac4f-132e7ba6e292} -

(no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -

C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet

Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft

Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft

Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON

Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common

Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft

ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker

Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program

Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program

Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite -

{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft

ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -

C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… -

{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft

ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -

http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK

Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb

ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer

Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer

Anti-Spyware Scanner) -

http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image

Uploader 3.5 Control) -

http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -

http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX

Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) -

http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman

Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner -

C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia

Licensing.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec

Corporation - C:\Program Files\Norton SystemWorks\Norton

Utilities\NPROTECT.EXE
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend

Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro

Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc.

- C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. -

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead

Systems, Inc. - C:\Program Files\Common Files\Ulead

Systems\DVD\ULCDRSvr.exe

THanks Ken,

No worries on any delay, I just really apprciate any help I can get. I've done what you suggested and the new log is below. Something I did do since my first post was run the log file through the anlayzer at http://www.hijackthis.de/ and based on that removed the most obvious ones that they analyzer tagged as nasty. I really hope that didn't mess anything up (the 'puter seems to be working a bit better).

Anyhow, here is the new log file.

Thanks again. Jim

Logfile of HijackThis v1.99.1
Scan saved at 9:08:50 PM, on 30/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Qualcomm\Eudora\Eudora.exe
C:\Program Files\Winsim\winsim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Thanks again Ken for all of your help. Point taken on my earlier use of that HJT analyzer. I could have screwed up my system big time.

My new HJT Log is below and following that the Spy Sweeper log. I'm not sure if it means anything, but I have not been able to update Spybot S&D prior to running everything that I ran today at your request. Now it updates just fine. Seems funny.

Also, I did notice that both Eudora and Outlook would not load on initial boot or reboot. I had to shut down completely and then they both started acting normally. I'll have to see how they behave now that I've done all this.

Anyway, enough babbling. Here are the logs and thanks again so much for all your help.

Jim

Logfile of HijackThis v1.99.1
Scan saved at 8:33:28 PM, on 31/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe


********
12:43 PM: | Start of Session, October 31, 2005 |
12:43 PM: Spy Sweeper started
12:43 PM: Sweep initiated using definitions version 564
12:43 PM: Starting Memory Sweep
12:44 PM: Memory Sweep Complete, Elapsed Time: 00:01:34
12:44 PM: Starting Registry Sweep
12:44 PM: Registry Sweep Complete, Elapsed Time:00:00:17
12:44 PM: Starting Cookie Sweep
12:44 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:45 PM: Starting File Sweep
12:51 PM: Found Adware: ist yoursitebar
12:51 PM: iinstall.exe (ID = 179422)
12:52 PM: File Sweep Complete, Elapsed Time: 00:07:22
12:52 PM: Full Sweep has completed. Elapsed time 00:09:16
12:52 PM: Traces Found: 1
8:17 PM: Removal process initiated
8:17 PM: Quarantining All Traces: ist yoursitebar
8:17 PM: Removal process completed. Elapsed time 00:00:01
********
12:29 PM: | Start of Session, October 31, 2005 |
12:29 PM: Spy Sweeper started
12:29 PM: Sweep initiated using definitions version 556
12:29 PM: Starting Memory Sweep
12:31 PM: Memory Sweep Complete, Elapsed Time: 00:01:21
12:31 PM: Starting Registry Sweep
12:31 PM: Found Adware: azsearch toolbar
12:31 PM: HKCR\azentretien.loader\ (5 subtraces) (ID = 103886)
12:31 PM: HKLM\software\azentretienco\ (2 subtraces) (ID = 103905)
12:31 PM: HKLM\software\classes\azentretien.loader.1\ (3 subtraces) (ID = 103909)
12:31 PM: HKLM\software\classes\azentretien.loader\ (5 subtraces) (ID = 103910)
12:31 PM: Found Adware: quicklink search toolbar
12:31 PM: HKLM\software\microsoft\windows\currentversion\uninstall\quick links\ (2 subtraces) (ID = 359457)
12:31 PM: HKLM\software\ql\ (4 subtraces) (ID = 359458)
12:31 PM: Registry Sweep Complete, Elapsed Time:00:00:23
12:31 PM: Starting Cookie Sweep
12:31 PM: Found Spy Cookie: 2o7.net cookie
12:31 PM: jim stang@2o7[2].txt (ID = 1957)
12:31 PM: Found Spy Cookie: about cookie
12:31 PM: jim stang@about[2].txt (ID = 2037)
12:31 PM: Found Spy Cookie: pointroll cookie
12:31 PM: jim [removed][1].txt (ID = 3148)
12:31 PM: Found Spy Cookie: a cookie
12:31 PM: jim stang@a[1].txt (ID = 2027)
12:31 PM: Found Spy Cookie: burstnet cookie
12:31 PM: jim stang@burstnet[2].txt (ID = 2336)
12:31 PM: Found Spy Cookie: casalemedia cookie
12:31 PM: jim stang@casalemedia[2].txt (ID = 2354)
12:31 PM: Found Spy Cookie: ru4 cookie
12:31 PM: jim stang@edge.ru4[2].txt (ID = 3269)
12:31 PM: jim [removed][1].txt (ID = 2038)
12:31 PM: Found Spy Cookie: questionmarket cookie
12:31 PM: jim stang@questionmarket[2].txt (ID = 3217)
12:31 PM: Found Spy Cookie: realmedia cookie
12:31 PM: jim stang@realmedia[1].txt (ID = 3235)
12:31 PM: Found Spy Cookie: tribalfusion cookie
12:31 PM: jim stang@tribalfusion[2].txt (ID = 3589)
12:31 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:31 PM: Starting File Sweep
12:31 PM: c:\program files\quick links (2 subtraces) (ID = -2147478145)
12:31 PM: Found Adware: winantispyware 2005
12:31 PM: uwfx5_0001_lpnetinstaller.exe (ID = 159893)
12:32 PM: Found Adware: shopathomeselect
12:32 PM: j64m956q.dat (ID = 75949)
12:32 PM: uwfx5_0001_lpnetinstaller.exe (ID = 159893)
12:32 PM: uninst.exe (ID = 73428)
12:33 PM: Found Adware: apropos
12:33 PM: wingenerics.dll (ID = 50187)
12:33 PM: azebar.xml (ID = 107190)
12:34 PM: qlink32.dll (ID = 153756)
12:37 PM: 26vsqaep.dat (ID = 75801)
12:37 PM: preuninstallql.exe (ID = 131326)
12:37 PM: Found Adware: personal money tree
12:37 PM: pmt.exe (ID = 137597)
12:37 PM: e3d9b.tmp (ID = 153752)
12:38 PM: uwfx5_0001_lpnetinstaller.inf (ID = 159894)
12:38 PM: backup-20050808-213625-150.inf (ID = 50329)
12:38 PM: File Sweep Complete, Elapsed Time: 00:06:43
12:38 PM: Full Sweep has completed. Elapsed time 00:08:32
12:38 PM: Traces Found: 54
12:38 PM: Removal process initiated
12:38 PM: Quarantining All Traces: apropos
12:38 PM: apropos is in use. It will be removed on reboot.
12:38 PM: wingenerics.dll is in use. It will be removed on reboot.
12:38 PM: Quarantining All Traces: azsearch toolbar
12:38 PM: Quarantining All Traces: personal money tree
12:38 PM: Quarantining All Traces: quicklink search toolbar
12:38 PM: Quarantining All Traces: shopathomeselect
12:38 PM: Quarantining All Traces: winantispyware 2005
12:38 PM: Quarantining All Traces: 2o7.net cookie
12:38 PM: Quarantining All Traces: a cookie
12:38 PM: Quarantining All Traces: about cookie
12:38 PM: Quarantining All Traces: burstnet cookie
12:38 PM: Quarantining All Traces: casalemedia cookie
12:38 PM: Quarantining All Traces: pointroll cookie
12:38 PM: Quarantining All Traces: questionmarket cookie
12:38 PM: Quarantining All Traces: realmedia cookie
12:38 PM: Quarantining All Traces: ru4 cookie
12:38 PM: Quarantining All Traces: tribalfusion cookie
12:40 PM: Preparing to restart your computer. Please wait…
12:40 PM: Removal process completed. Elapsed time 00:01:34
12:42 PM: Updating spyware definitions
12:42 PM: Your spyware definitions have been updated.
12:43 PM: | End of Session, October 31, 2005 |
********
12:23 PM: | Start of Session, October 31, 2005 |
12:23 PM: Spy Sweeper started
12:24 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:27 PM: Updating spyware definitions
12:27 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:28 PM: Updating spyware definitions
12:28 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:29 PM: | End of Session, October 31, 2005 |

Hi Ken,

I've run both sweeps and am posting the new logs below. Thanks again for all the help.

Jim


Logfile of HijackThis v1.99.1
Scan saved at 12:39:00 PM, on 01/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\explorer.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =

Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName

=
N3 - Netscape 7: user_pref("browser.startup.homepage",

"http://home.netscape.com/bookmark/7_2/home.html"); (C:\Documents and

Settings\Jim Stang\Application

Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine",

"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%

5CSBWeb_01.src"); (C:\Documents and Settings\Jim Stang\Application

Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} -

C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

- C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -

C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet

Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft

Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft

Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON

Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common

Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy

Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft

ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker

Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program

Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program

Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite -

{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft

ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -

C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… -

{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft

ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -

http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb

ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer

Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer

Anti-Spyware Scanner) -

http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image

Uploader 3.5 Control) -

http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -

http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) -

http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman

Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner -

C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia

Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend

Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot

Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro

Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc.

- C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. -

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead

Systems, Inc. - C:\Program Files\Common Files\Ulead

Systems\DVD\ULCDRSvr.exe



********
12:36 PM: | Start of Session, November 1, 2005 |
12:36 PM: Spy Sweeper started
12:36 PM: Sweep initiated using definitions version 564
12:36 PM: Starting Memory Sweep
12:36 PM: Sweep Canceled
12:36 PM: Memory Sweep Complete, Elapsed Time: 00:00:03
12:36 PM: Traces Found: 0
********
12:27 PM: | Start of Session, November 1, 2005 |
12:27 PM: Spy Sweeper started
12:27 PM: Sweep initiated using definitions version 564
12:27 PM: Starting Memory Sweep
12:28 PM: Memory Sweep Complete, Elapsed Time: 00:01:31
12:28 PM: Starting Registry Sweep
12:29 PM: Registry Sweep Complete, Elapsed Time:00:00:17
12:29 PM: Starting Cookie Sweep
12:29 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:29 PM: Starting File Sweep
12:36 PM: File Sweep Complete, Elapsed Time: 00:07:23
12:36 PM: Full Sweep has completed. Elapsed time 00:09:14
12:36 PM: Traces Found: 0
12:36 PM: | End of Session, November 1, 2005 |
********
12:15 PM: | Start of Session, November 1, 2005 |
12:15 PM: Spy Sweeper started
12:15 PM: Sweep initiated using definitions version 564
12:15 PM: Starting Memory Sweep
12:17 PM: Memory Sweep Complete, Elapsed Time: 00:01:41
12:17 PM: Starting Registry Sweep
12:17 PM: Registry Sweep Complete, Elapsed Time:00:00:16
12:17 PM: Starting Cookie Sweep
12:17 PM: Found Spy Cookie: 2o7.net cookie
12:17 PM: jim stang@2o7[2].txt (ID = 1957)
12:17 PM: Found Spy Cookie: adlegend cookie
12:17 PM: jim stang@adlegend[1].txt (ID = 2074)
12:17 PM: Found Spy Cookie: zedo cookie
12:17 PM: jim stang@zedo[2].txt (ID = 3762)
12:17 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:17 PM: Starting File Sweep
12:24 PM: File Sweep Complete, Elapsed Time: 00:07:11
12:24 PM: Full Sweep has completed. Elapsed time 00:09:12
12:24 PM: Traces Found: 3
12:24 PM: Removal process initiated
12:24 PM: Quarantining All Traces: 2o7.net cookie
12:24 PM: Quarantining All Traces: adlegend cookie
12:24 PM: Quarantining All Traces: zedo cookie
12:24 PM: Removal process completed. Elapsed time 00:00:01
********
12:14 PM: | Start of Session, November 1, 2005 |
12:14 PM: Spy Sweeper started
12:14 PM: Sweep initiated using definitions version 564
12:14 PM: Starting Memory Sweep
12:14 PM: Sweep Canceled
12:14 PM: Memory Sweep Complete, Elapsed Time: 00:00:04
12:14 PM: Traces Found: 0
12:14 PM: Updating spyware definitions
12:14 PM: Your definitions are up to date.
12:15 PM: | End of Session, November 1, 2005 |
********
12:43 PM: | Start of Session, October 31, 2005 |
12:43 PM: Spy Sweeper started
12:43 PM: Sweep initiated using definitions version 564
12:43 PM: Starting Memory Sweep
12:44 PM: Memory Sweep Complete, Elapsed Time: 00:01:34
12:44 PM: Starting Registry Sweep
12:44 PM: Registry Sweep Complete, Elapsed Time:00:00:17
12:44 PM: Starting Cookie Sweep
12:44 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:45 PM: Starting File Sweep
12:51 PM: Found Adware: ist yoursitebar
12:51 PM: iinstall.exe (ID = 179422)
12:52 PM: File Sweep Complete, Elapsed Time: 00:07:22
12:52 PM: Full Sweep has completed. Elapsed time 00:09:16
12:52 PM: Traces Found: 1
8:17 PM: Removal process initiated
8:17 PM: Quarantining All Traces: ist yoursitebar
8:17 PM: Removal process completed. Elapsed time 00:00:01
8:19 PM: Processing Internet Explorer Favorites Alerts
8:19 PM: Removed IE Favorite: Pangaea Inc
********
12:29 PM: | Start of Session, October 31, 2005 |
12:29 PM: Spy Sweeper started
12:29 PM: Sweep initiated using definitions version 556
12:29 PM: Starting Memory Sweep
12:31 PM: Memory Sweep Complete, Elapsed Time: 00:01:21
12:31 PM: Starting Registry Sweep
12:31 PM: Found Adware: azsearch toolbar
12:31 PM: HKCR\azentretien.loader\ (5 subtraces) (ID = 103886)
12:31 PM: HKLM\software\azentretienco\ (2 subtraces) (ID = 103905)
12:31 PM: HKLM\software\classes\azentretien.loader.1\ (3 subtraces) (ID = 103909)
12:31 PM: HKLM\software\classes\azentretien.loader\ (5 subtraces) (ID = 103910)
12:31 PM: Found Adware: quicklink search toolbar
12:31 PM: HKLM\software\microsoft\windows\currentversion\uninstall\quick links\ (2 subtraces) (ID = 359457)
12:31 PM: HKLM\software\ql\ (4 subtraces) (ID = 359458)
12:31 PM: Registry Sweep Complete, Elapsed Time:00:00:23
12:31 PM: Starting Cookie Sweep
12:31 PM: Found Spy Cookie: 2o7.net cookie
12:31 PM: jim stang@2o7[2].txt (ID = 1957)
12:31 PM: Found Spy Cookie: about cookie
12:31 PM: jim stang@about[2].txt (ID = 2037)
12:31 PM: Found Spy Cookie: pointroll cookie
12:31 PM: jim [removed][1].txt (ID = 3148)
12:31 PM: Found Spy Cookie: a cookie
12:31 PM: jim stang@a[1].txt (ID = 2027)
12:31 PM: Found Spy Cookie: burstnet cookie
12:31 PM: jim stang@burstnet[2].txt (ID = 2336)
12:31 PM: Found Spy Cookie: casalemedia cookie
12:31 PM: jim stang@casalemedia[2].txt (ID = 2354)
12:31 PM: Found Spy Cookie: ru4 cookie
12:31 PM: jim stang@edge.ru4[2].txt (ID = 3269)
12:31 PM: jim [removed][1].txt (ID = 2038)
12:31 PM: Found Spy Cookie: questionmarket cookie
12:31 PM: jim stang@questionmarket[2].txt (ID = 3217)
12:31 PM: Found Spy Cookie: realmedia cookie
12:31 PM: jim stang@realmedia[1].txt (ID = 3235)
12:31 PM: Found Spy Cookie: tribalfusion cookie
12:31 PM: jim stang@tribalfusion[2].txt (ID = 3589)
12:31 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:31 PM: Starting File Sweep
12:31 PM: c:\program files\quick links (2 subtraces) (ID = -2147478145)
12:31 PM: Found Adware: winantispyware 2005
12:31 PM: uwfx5_0001_lpnetinstaller.exe (ID = 159893)
12:32 PM: Found Adware: shopathomeselect
12:32 PM: j64m956q.dat (ID = 75949)
12:32 PM: uwfx5_0001_lpnetinstaller.exe (ID = 159893)
12:32 PM: uninst.exe (ID = 73428)
12:33 PM: Found Adware: apropos
12:33 PM: wingenerics.dll (ID = 50187)
12:33 PM: azebar.xml (ID = 107190)
12:34 PM: qlink32.dll (ID = 153756)
12:37 PM: 26vsqaep.dat (ID = 75801)
12:37 PM: preuninstallql.exe (ID = 131326)
12:37 PM: Found Adware: personal money tree
12:37 PM: pmt.exe (ID = 137597)
12:37 PM: e3d9b.tmp (ID = 153752)
12:38 PM: uwfx5_0001_lpnetinstaller.inf (ID = 159894)
12:38 PM: backup-20050808-213625-150.inf (ID = 50329)
12:38 PM: File Sweep Complete, Elapsed Time: 00:06:43
12:38 PM: Full Sweep has completed. Elapsed time 00:08:32
12:38 PM: Traces Found: 54
12:38 PM: Removal process initiated
12:38 PM: Quarantining All Traces: apropos
12:38 PM: apropos is in use. It will be removed on reboot.
12:38 PM: wingenerics.dll is in use. It will be removed on reboot.
12:38 PM: Quarantining All Traces: azsearch toolbar
12:38 PM: Quarantining All Traces: personal money tree
12:38 PM: Quarantining All Traces: quicklink search toolbar
12:38 PM: Quarantining All Traces: shopathomeselect
12:38 PM: Quarantining All Traces: winantispyware 2005
12:38 PM: Quarantining All Traces: 2o7.net cookie
12:38 PM: Quarantining All Traces: a cookie
12:38 PM: Quarantining All Traces: about cookie
12:38 PM: Quarantining All Traces: burstnet cookie
12:38 PM: Quarantining All Traces: casalemedia cookie
12:38 PM: Quarantining All Traces: pointroll cookie
12:38 PM: Quarantining All Traces: questionmarket cookie
12:38 PM: Quarantining All Traces: realmedia cookie
12:38 PM: Quarantining All Traces: ru4 cookie
12:38 PM: Quarantining All Traces: tribalfusion cookie
12:40 PM: Preparing to restart your computer. Please wait…
12:40 PM: Removal process completed. Elapsed time 00:01:34
12:42 PM: Updating spyware definitions
12:42 PM: Your spyware definitions have been updated.
12:43 PM: | End of Session, October 31, 2005 |
********
12:23 PM: | Start of Session, October 31, 2005 |
12:23 PM: Spy Sweeper started
12:24 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:27 PM: Updating spyware definitions
12:27 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:28 PM: Updating spyware definitions
12:28 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:29 PM: | End of Session, October 31, 2005 |

Hi Ken,

Sorry for the confusion with the HJT logs. I have been using edit > select all > copy and paste, so I was surprised to see that not working properly. I'll be sure to check more closely this time.

My unsubscribe log and new HJT log at below.

Thanks again,

Jim

Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Illustrator 10
Adobe PageMaker 7.0
Adobe Photoshop 6.0
Adobe Reader 6.0.2
Adobe SVG Viewer 3.0
ADS Tech Master Installer V3.5
ADS Tech V3.5 DVD Xpress CapWiz
AviSynth 2.5
Best Video to Audio Converter 1.30
CARD LINK (for USB) 1.20
CCHelp
CCScore
ContextPlus
DivX Player
DivX Pro Trial
d'peg! - Duplicate Graphic File Manager
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVD to VCD AVI DivX Converter v3.2 (build 069)
DVD2SVCD 1.2.2 Build 3
EPSON Print CD
EPSON Printer Software
EPSON SP R200 Reference Guide
ESSAdpt
ESSANUP
ESSBrwr
ESSCAM
ESSCDBK
ESScore
ESSCT
ESSEMAIL
ESSgui
ESShelp
ESSini
ESSPCD
ESSSONIC
ESSvpaht
ESSvpot
Eudora
Film Factory
GoldWave v5.10
HijackThis 1.99.1
HLPCCTR
HLPIndex
HLPSFO
InterVideo WinDVD 4
InterVideo WinDVD Creator
IsoBuster 1.8
J2SE Runtime Environment 5.0 Update 4
Java 2 Runtime Environment, SE v1.4.1_02
Java Web Start
JCVGantt for MindManager X5
Jfuse
Kodak EasyShare software
KSU
LimeWire 4.9.33
LiveUpdate 2.6 (Symantec Corporation)
Macromedia Dreamweaver MX 2004
Macromedia Fireworks MX 2004
Macromedia Flash MX 2004
Macromedia FreeHand MXa
Macromedia Shockwave Player
Marketing Plan Pro 6.0
MediaFACE 4.01
Microsoft ActiveSync 3.8
Microsoft Data Access Components KB870669
Microsoft Office 2000 SR-1 Standard
MindManager X5 Pro
MPEG Joiner version 1.0.0
MSI Live Update 3
myBatchConverter 2.1
Nero 6 Ultra Edition
Netscape (7.2)
Notifier
OfotoXMI
OTtBP
OTtBPSDK
Palmcorder USB Device Driver 3.01
PCDLNCH
PDF-XChange 3.0
Peck's Power Join
Personal Archive Creator 3.0
PHOTOVU / MPEG4 Movie Messenger System 1.01
Quicken Deluxe 2000
QuickPar 0.9
QuickTime
RealPlayer
Realtek AC'97 Audio
RenameWiz Version 3.4.2
Responsive Time Logger
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
SFR
SFR2
Simply Accounting 2005 Pro
SnagIt 7
Sonic Audio Module
Sonic CinePlayer
Sonic Copy Module
Sonic Data Module
Sonic DLA
Sonic MyDVD Studio Deluxe
Sonic Update Manager
Spy Sweeper
Spybot - Search & Destroy 1.4
ThumbsPlus version 5.01-R
TMPGEnc 3.0 XPress
Trend Micro PC-cillin Internet Security 2005
Ulead DVD MovieFactory 3 SE
Ulead DVD Workshop 2
Ulead Straight-to-Disc SDK
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
VCAMCEN
VPRINTOL
Winamp (remove only)
WinASO Registry Optimizer 2.0.6
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885626
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinRAR archiver
WinZip


Logfile of HijackThis v1.99.1
Scan saved at 6:59:14 PM, on 01/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Hi Ken,

Everything has been done as requested. The new HJT log, the aproposefix log and the Spysweeper logs follow.

Question. Are you a volunteer here? How many of you are there working these forums? I can't tell you how much help you've been.

Jim

Logfile of HijackThis v1.99.1
Scan saved at 8:47:54 PM, on 01/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C:\Documents and Settings\Jim Stang\Application

Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");

(C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001"

/M "Stylus Photo R200"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSv



Log of AproposFix v1

************

Running from directory:
C:\Documents and Settings\Jim Stang\Desktop\aproposfix

************

Registry entries found:

[HKEY_LOCAL_MACHINE\Software\C0TXmAxmggs9]
@="mmX8gu3GHHGHHIHDYwkZCNEGHHGWJHqchXiqmH8E89y2NMHx7.By78H.7v7yz19I8E8"
"Device"="\\\\.\\xEcQFw3y"
"DriverPath"="C:\\WINDOWS\\system32\\drivers\\irbreflt.sys"
"DriverName"="SSDsMan"
"HideUninstallerName"="C:\\Program Files\\Minnth 2\\verl_mtf.exe"
"UninstallerPath"="C:\\WINDOWS\\system32\\subispex.exe"
"UninstallerRegKey"="HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{02799934-6EC2-4C4C-AE5B-F03F320D048D}"
"UninstallerParams"="/CTUN"
"HDll"="C:\\WINDOWS\\system32\\quadmdbg.dll"
"ServerAddress"="adchannel.contextplus.net"
"LegalNote"="http://adchannel.contextplus.net/legal-note/nonbranded.html"
"PartnerId"="CP.IST2"
"InstallationId"="{Xf48966b-ac17-02f4-2f40-4c587b002a92}"
"PageFiltering"=dword:00000001
"ClientName"="C:\\Program Files\\Minnth 2\\msijet32.exe"

************

Removing hidden service:
Service SSDsMan removed.

Removing hidden folder:

Deleting files:

Deletion of file C:\WINDOWS\system32\drivers\irbreflt.sys succeeded!
Deletion of file C:\WINDOWS\system32\cardlg32.exe succeeded!
Deletion of file C:\WINDOWS\system32\quadmdbg.dll succeeded!
Deletion of file C:\WINDOWS\system32\subispex.exe succeeded!

Backing up files:
Done!

Removing registry entries:

REGEDIT4

[-HKEY_CURRENT_USER\Software\C0TXmAxmggs9]
[-HKEY_LOCAL_MACHINE\Software\C0TXmAxmggs9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{02799934-6EC2-4C4C-AE5B-F03F320D048D}]

Done!

Finished!


********
8:48 PM: | Start of Session, November 1, 2005 |
8:48 PM: Spy Sweeper started
8:48 PM: Sweep initiated using definitions version 564
8:48 PM: Starting Memory Sweep
8:50 PM: Memory Sweep Complete, Elapsed Time: 00:01:43
8:50 PM: Starting Registry Sweep
8:50 PM: Registry Sweep Complete, Elapsed Time:00:00:14
8:50 PM: Starting Cookie Sweep
8:50 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
8:50 PM: Starting File Sweep
8:57 PM: File Sweep Complete, Elapsed Time: 00:07:14
8:57 PM: Full Sweep has completed. Elapsed time 00:09:14
8:57 PM: Traces Found: 0
********
12:36 PM: | Start of Session, November 1, 2005 |
12:36 PM: Spy Sweeper started
12:36 PM: Sweep initiated using definitions version 564
12:36 PM: Starting Memory Sweep
12:36 PM: Sweep Canceled
12:36 PM: Memory Sweep Complete, Elapsed Time: 00:00:03
12:36 PM: Traces Found: 0
********
12:27 PM: | Start of Session, November 1, 2005 |
12:27 PM: Spy Sweeper started
12:27 PM: Sweep initiated using definitions version 564
12:27 PM: Starting Memory Sweep
12:28 PM: Memory Sweep Complete, Elapsed Time: 00:01:31
12:28 PM: Starting Registry Sweep
12:29 PM: Registry Sweep Complete, Elapsed Time:00:00:17
12:29 PM: Starting Cookie Sweep
12:29 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:29 PM: Starting File Sweep
12:36 PM: File Sweep Complete, Elapsed Time: 00:07:23
12:36 PM: Full Sweep has completed. Elapsed time 00:09:14
12:36 PM: Traces Found: 0
12:36 PM: | End of Session, November 1, 2005 |
********
12:15 PM: | Start of Session, November 1, 2005 |
12:15 PM: Spy Sweeper started
12:15 PM: Sweep initiated using definitions version 564
12:15 PM: Starting Memory Sweep
12:17 PM: Memory Sweep Complete, Elapsed Time: 00:01:41
12:17 PM: Starting Registry Sweep
12:17 PM: Registry Sweep Complete, Elapsed Time:00:00:16
12:17 PM: Starting Cookie Sweep
12:17 PM: Found Spy Cookie: 2o7.net cookie
12:17 PM: jim stang@2o7[2].txt (ID = 1957)
12:17 PM: Found Spy Cookie: adlegend cookie
12:17 PM: jim stang@adlegend[1].txt (ID = 2074)
12:17 PM: Found Spy Cookie: zedo cookie
12:17 PM: jim stang@zedo[2].txt (ID = 3762)
12:17 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:17 PM: Starting File Sweep
12:24 PM: File Sweep Complete, Elapsed Time: 00:07:11
12:24 PM: Full Sweep has completed. Elapsed time 00:09:12
12:24 PM: Traces Found: 3
12:24 PM: Removal process initiated
12:24 PM: Quarantining All Traces: 2o7.net cookie
12:24 PM: Quarantining All Traces: adlegend cookie
12:24 PM: Quarantining All Traces: zedo cookie
12:24 PM: Removal process completed. Elapsed time 00:00:01
********
12:14 PM: | Start of Session, November 1, 2005 |
12:14 PM: Spy Sweeper started
12:14 PM: Sweep initiated using definitions version 564
12:14 PM: Starting Memory Sweep
12:14 PM: Sweep Canceled
12:14 PM: Memory Sweep Complete, Elapsed Time: 00:00:04
12:14 PM: Traces Found: 0
12:14 PM: Updating spyware definitions
12:14 PM: Your definitions are up to date.
12:15 PM: | End of Session, November 1, 2005 |
********
12:43 PM: | Start of Session, October 31, 2005 |
12:43 PM: Spy Sweeper started
12:43 PM: Sweep initiated using definitions version 564
12:43 PM: Starting Memory Sweep
12:44 PM: Memory Sweep Complete, Elapsed Time: 00:01:34
12:44 PM: Starting Registry Sweep
12:44 PM: Registry Sweep Complete, Elapsed Time:00:00:17
12:44 PM: Starting Cookie Sweep
12:44 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:45 PM: Starting File Sweep
12:51 PM: Found Adware: ist yoursitebar
12:51 PM: iinstall.exe (ID = 179422)
12:52 PM: File Sweep Complete, Elapsed Time: 00:07:22
12:52 PM: Full Sweep has completed. Elapsed time 00:09:16
12:52 PM: Traces Found: 1
8:17 PM: Removal process initiated
8:17 PM: Quarantining All Traces: ist yoursitebar
8:17 PM: Removal process completed. Elapsed time 00:00:01
8:19 PM: Processing Internet Explorer Favorites Alerts
8:19 PM: Removed IE Favorite: Pangaea Inc
********
12:29 PM: | Start of Session, October 31, 2005 |
12:29 PM: Spy Sweeper started
12:29 PM: Sweep initiated using definitions version 556
12:29 PM: Starting Memory Sweep
12:31 PM: Memory Sweep Complete, Elapsed Time: 00:01:21
12:31 PM: Starting Registry Sweep
12:31 PM: Found Adware: azsearch toolbar
12:31 PM: HKCR\azentretien.loader\ (5 subtraces) (ID = 103886)
12:31 PM: HKLM\software\azentretienco\ (2 subtraces) (ID = 103905)
12:31 PM: HKLM\software\classes\azentretien.loader.1\ (3 subtraces) (ID = 103909)
12:31 PM: HKLM\software\classes\azentretien.loader\ (5 subtraces) (ID = 103910)
12:31 PM: Found Adware: quicklink search toolbar
12:31 PM: HKLM\software\microsoft\windows\currentversion\uninstall\quick links\ (2 subtraces) (ID = 359457)
12:31 PM: HKLM\software\ql\ (4 subtraces) (ID = 359458)
12:31 PM: Registry Sweep Complete, Elapsed Time:00:00:23
12:31 PM: Starting Cookie Sweep
12:31 PM: Found Spy Cookie: 2o7.net cookie
12:31 PM: jim stang@2o7[2].txt (ID = 1957)
12:31 PM: Found Spy Cookie: about cookie
12:31 PM: jim stang@about[2].txt (ID = 2037)
12:31 PM: Found Spy Cookie: pointroll cookie
12:31 PM: jim [removed][1].txt (ID = 3148)
12:31 PM: Found Spy Cookie: a cookie
12:31 PM: jim stang@a[1].txt (ID = 2027)
12:31 PM: Found Spy Cookie: burstnet cookie
12:31 PM: jim stang@burstnet[2].txt (ID = 2336)
12:31 PM: Found Spy Cookie: casalemedia cookie
12:31 PM: jim stang@casalemedia[2].txt (ID = 2354)
12:31 PM: Found Spy Cookie: ru4 cookie
12:31 PM: jim stang@edge.ru4[2].txt (ID = 3269)
12:31 PM: jim [removed][1].txt (ID = 2038)
12:31 PM: Found Spy Cookie: questionmarket cookie
12:31 PM: jim stang@questionmarket[2].txt (ID = 3217)
12:31 PM: Found Spy Cookie: realmedia cookie
12:31 PM: jim stang@realmedia[1].txt (ID = 3235)
12:31 PM: Found Spy Cookie: tribalfusion cookie
12:31 PM: jim stang@tribalfusion[2].txt (ID = 3589)
12:31 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:31 PM: Starting File Sweep
12:31 PM: c:\program files\quick links (2 subtraces) (ID = -2147478145)
12:31 PM: Found Adware: winantispyware 2005
12:31 PM: uwfx5_0001_lpnetinstaller.exe (ID = 159893)
12:32 PM: Found Adware: shopathomeselect
12:32 PM: j64m956q.dat (ID = 75949)
12:32 PM: uwfx5_0001_lpnetinstaller.exe (ID = 159893)
12:32 PM: uninst.exe (ID = 73428)
12:33 PM: Found Adware: apropos
12:33 PM: wingenerics.dll (ID = 50187)
12:33 PM: azebar.xml (ID = 107190)
12:34 PM: qlink32.dll (ID = 153756)
12:37 PM: 26vsqaep.dat (ID = 75801)
12:37 PM: preuninstallql.exe (ID = 131326)
12:37 PM: Found Adware: personal money tree
12:37 PM: pmt.exe (ID = 137597)
12:37 PM: e3d9b.tmp (ID = 153752)
12:38 PM: uwfx5_0001_lpnetinstaller.inf (ID = 159894)
12:38 PM: backup-20050808-213625-150.inf (ID = 50329)
12:38 PM: File Sweep Complete, Elapsed Time: 00:06:43
12:38 PM: Full Sweep has completed. Elapsed time 00:08:32
12:38 PM: Traces Found: 54
12:38 PM: Removal process initiated
12:38 PM: Quarantining All Traces: apropos
12:38 PM: apropos is in use. It will be removed on reboot.
12:38 PM: wingenerics.dll is in use. It will be removed on reboot.
12:38 PM: Quarantining All Traces: azsearch toolbar
12:38 PM: Quarantining All Traces: personal money tree
12:38 PM: Quarantining All Traces: quicklink search toolbar
12:38 PM: Quarantining All Traces: shopathomeselect
12:38 PM: Quarantining All Traces: winantispyware 2005
12:38 PM: Quarantining All Traces: 2o7.net cookie
12:38 PM: Quarantining All Traces: a cookie
12:38 PM: Quarantining All Traces: about cookie
12:38 PM: Quarantining All Traces: burstnet cookie
12:38 PM: Quarantining All Traces: casalemedia cookie
12:38 PM: Quarantining All Traces: pointroll cookie
12:38 PM: Quarantining All Traces: questionmarket cookie
12:38 PM: Quarantining All Traces: realmedia cookie
12:38 PM: Quarantining All Traces: ru4 cookie
12:38 PM: Quarantining All Traces: tribalfusion cookie
12:40 PM: Preparing to restart your computer. Please wait…
12:40 PM: Removal process completed. Elapsed time 00:01:34
12:42 PM: Updating spyware definitions
12:42 PM: Your spyware definitions have been updated.
12:43 PM: | End of Session, October 31, 2005 |
********
12:23 PM: | Start of Session, October 31, 2005 |
12:23 PM: Spy Sweeper started
12:24 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:27 PM: Updating spyware definitions
12:27 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:28 PM: Updating spyware definitions
12:28 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
12:29 PM: | End of Session, October 31, 2005 |

Hi Ken,

Hope your day is going well. Blacklight didn't find anything during its scan. I've attached a new HJT log below. I'm hoping you find nada.

Thanks again,

Jim


Logfile of HijackThis v1.99.1
Scan saved at 8:29:45 PM, on 02/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Jim Stang\Application Data\Mozilla\Profiles\default\a88v1l92.slt\prefs.js)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photolab.ca/en/Photo/ImageUploader3.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe