What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Winfixer, more like wincrap!

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have MS Antispyware, Adaware, and Spybot I have no clue where this came from! THanks in advance! Here's the log:

Logfile of HijackThis v1.99.1
Scan saved at 12:04:23 PM, on 11/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Boingo\WENGINE\wmonitor.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
D:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Program Files\AIM\aim.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Justin\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://excite.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSEvents Object - {B313D637-F405-4052-AC37-E2119AB3C8F8} - C:\WINDOWS\system32\rqopp.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "D:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: PowerPanel.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - D:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1116047892953
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: rqopp - C:\WINDOWS\system32\rqopp.dll
O23 - Service: Boingo Monitor Service (BoingoMonitor) - Boingo Wireless, Inc. - C:\Program Files\Boingo\WENGINE\wmonitor.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP (file missing)
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP (file missing)
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
Post #2
Hello sims562, welcome to the forum. Sorry about the delay in responding :( If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread.
Post #3
here ya go!

Logfile of HijackThis v1.99.1
Scan saved at 11:41:24 AM, on 11/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Boingo\WENGINE\wmonitor.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\AIM\aim.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
D:\Program Files\thunderbird\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Justin\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://excite.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat

6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar3.dll
O2 - BHO: MSEvents Object - {B313D637-F405-4052-AC37-E2119AB3C8F8} - C:\WINDOWS\system32\rqopp.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton

AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton

AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "D:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: PowerPanel.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program

files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program

files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program

files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program

Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program

Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - D:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://v5.windowsupdate.microsoft.com/v5co…b?1116047892953
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -

http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) -

http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) -

https://secure.logmein.com/activex/ractrl.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: rqopp - C:\WINDOWS\system32\rqopp.dll
O23 - Service: Boingo Monitor Service (BoingoMonitor) - Boingo Wireless, Inc. - C:\Program

Files\Boingo\WENGINE\wmonitor.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton

SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton

SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program

Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -

C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program

Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\Security Center\SymWSC.exe
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:\Program

Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer

/DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:\Program

Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP

/RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP (file missing)
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program

Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:\Program

Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:\Program

Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP

/RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP (file missing)
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program

Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program

Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer

/DisplayName="VAIO Media Video Server (file missing)
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program

Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP

/RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program

Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
Post #4
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Before posting the HJT log, turn WordWrap OFF in Notepad.
Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.
Post #5
I was getting popups in IE, but since the sweep and actually getting that rqopp.dll removed I don't see any problems, do you know where this could have come from? ******** 3:16 PM: | Start of Session, Saturday, November 19, 2005 | 3:16 PM: Spy Sweeper started 3:16 PM: Sweep initiated using definitions version 574 3:16 PM: Starting Memory Sweep 3:22 PM: Found Adware: virtumonde 3:22 PM: Detected running threat: C:\WINDOWS\system32\rqopp.dll (ID = 77) 3:42 PM: Memory Sweep Complete, Elapsed Time: 00:26:21 3:42 PM: Starting Registry Sweep 3:45 PM: Found Adware: trustyhound toolbar 3:45 PM: HKU\S-1-5-21-1056472089-4241767241-527367138-1005\software\xbtb01786\ (1 subtraces) (ID = 145197) 3:46 PM: Registry Sweep Complete, Elapsed Time:00:04:14 3:46 PM: Starting Cookie Sweep 3:47 PM: Found Spy Cookie: 2o7.net cookie 3:47 PM: justin@112.2o7[2].txt (ID = 1958) 3:47 PM: justin@2o7[2].txt (ID = 1957) 3:47 PM: Found Spy Cookie: websponsors cookie 3:47 PM: [removed][1].txt (ID = 3665) 3:47 PM: Found Spy Cookie: aa cookie 3:47 PM: justin@aa[2].txt (ID = 2029) 3:47 PM: Found Spy Cookie: go.com cookie 3:47 PM: [removed][2].txt (ID = 2729) 3:47 PM: [removed][2].txt (ID = 2729) 3:47 PM: Found Spy Cookie: about cookie 3:47 PM: justin@about[2].txt (ID = 2037) 3:47 PM: Found Spy Cookie: ad-rotator cookie 3:47 PM: justin@ad-rotator[1].txt (ID = 2051) 3:47 PM: Found Spy Cookie: yieldmanager cookie 3:47 PM: [removed][2].txt (ID = 3751) 3:47 PM: Found Spy Cookie: adknowledge cookie 3:47 PM: justin@adknowledge[1].txt (ID = 2072) 3:47 PM: Found Spy Cookie: adlegend cookie 3:47 PM: justin@adlegend[2].txt (ID = 2074) 3:47 PM: Found Spy Cookie: hbmediapro cookie 3:47 PM: [removed][2].txt (ID = 2768) 3:47 PM: Found Spy Cookie: precisead cookie 3:47 PM: [removed][1].txt (ID = 3182) 3:47 PM: Found Spy Cookie: specificclick.com cookie 3:47 PM: [removed][1].txt (ID = 3400) 3:47 PM: Found Spy Cookie: adorigin cookie 3:47 PM: justin@adorigin[2].txt (ID = 2082) 3:47 PM: Found Spy Cookie: adrevolver cookie 3:47 PM: justin@adrevolver[1].txt (ID = 2088) 3:47 PM: justin@adrevolver[3].txt (ID = 2088) 3:47 PM: Found Spy Cookie: ads.businessweek cookie 3:47 PM: [removed][1].txt (ID = 2113) 3:47 PM: Found Spy Cookie: pointroll cookie 3:47 PM: [removed][1].txt (ID = 3148) 3:47 PM: Found Spy Cookie: falkag cookie 3:47 PM: [removed][1].txt (ID = 2650) 3:47 PM: Found Spy Cookie: ask cookie 3:47 PM: justin@ask[1].txt (ID = 2245) 3:47 PM: Found Spy Cookie: belnk cookie 3:47 PM: [removed][1].txt (ID = 2293) 3:47 PM: Found Spy Cookie: atwola cookie 3:47 PM: justin@atwola[1].txt (ID = 2255) 3:47 PM: Found Spy Cookie: azjmp cookie 3:47 PM: justin@azjmp[2].txt (ID = 2270) 3:47 PM: Found Spy Cookie: bannerspace cookie 3:47 PM: justin@bannerspace[1].txt (ID = 2284) 3:47 PM: Found Spy Cookie: banner cookie 3:47 PM: justin@banner[2].txt (ID = 2276) 3:47 PM: justin@belnk[1].txt (ID = 2292) 3:47 PM: Found Spy Cookie: bizrate cookie 3:47 PM: justin@bizrate[2].txt (ID = 2308) 3:47 PM: Found Spy Cookie: touchclarity cookie 3:47 PM: [removed][1].txt (ID = 3566) 3:47 PM: Found Spy Cookie: burstnet cookie 3:47 PM: justin@burstnet[2].txt (ID = 2336) 3:47 PM: justin@buycom.122.2o7[1].txt (ID = 1958) 3:47 PM: Found Spy Cookie: gostats cookie 3:47 PM: [removed][2].txt (ID = 2748) 3:47 PM: Found Spy Cookie: callwave cookie 3:47 PM: justin@callwave[2].txt (ID = 2342) 3:47 PM: justin@cartoonnetwork.122.2o7[1].txt (ID = 1958) 3:47 PM: Found Spy Cookie: casalemedia cookie 3:47 PM: justin@casalemedia[2].txt (ID = 2354) 3:47 PM: Found Spy Cookie: centrport net cookie 3:47 PM: justin@centrport[2].txt (ID = 2374) 3:47 PM: [removed][1].txt (ID = 2038) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: Found Spy Cookie: consumerfreedom.com cookie 3:48 PM: justin@consumerfreedom[2].txt (ID = 2459) 3:48 PM: Found Spy Cookie: 360i cookie 3:48 PM: justin@ct.360i[1].txt (ID = 1962) 3:48 PM: Found Spy Cookie: customer cookie 3:48 PM: justin@customer[1].txt (ID = 2481) 3:48 PM: justin@customer[2].txt (ID = 2481) 3:48 PM: Found Spy Cookie: did-it cookie 3:48 PM: justin@did-it[2].txt (ID = 2523) 3:48 PM: justin@digitalhomediscountptyltd.122.2o7[2].txt (ID = 1958) 3:48 PM: Found Spy Cookie: directtrack cookie 3:48 PM: justin@directtrack[1].txt (ID = 2527) 3:48 PM: [removed][2].txt (ID = 2293) 3:48 PM: Found Spy Cookie: ru4 cookie 3:48 PM: justin@edge.ru4[1].txt (ID = 3269) 3:48 PM: [removed][2].txt (ID = 2038) 3:48 PM: Found Spy Cookie: excite cookie 3:48 PM: justin@excite[2].txt (ID = 2631) 3:48 PM: [removed][2].txt (ID = 2038) 3:48 PM: Found Spy Cookie: experclick cookie 3:48 PM: justin@experclick[1].txt (ID = 2639) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: [removed][2].txt (ID = 2038) 3:48 PM: Found Spy Cookie: gamespy cookie 3:48 PM: justin@gamespy[1].txt (ID = 2719) 3:48 PM: Found Spy Cookie: go2net.com cookie 3:48 PM: justin@go2net[1].txt (ID = 2730) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: justin@gostats[1].txt (ID = 2747) 3:48 PM: justin@go[2].txt (ID = 2728) 3:48 PM: Found Spy Cookie: clickandtrack cookie 3:48 PM: [removed][1].txt (ID = 2397) 3:48 PM: Found Spy Cookie: howstuffworks cookie 3:48 PM: justin@howstuffworks[1].txt (ID = 2805) 3:48 PM: Found Spy Cookie: hypertracker.com cookie 3:48 PM: justin@hypertracker[1].txt (ID = 2817) 3:48 PM: Found Spy Cookie: ic-live cookie 3:48 PM: justin@ic-live[1].txt (ID = 2821) 3:48 PM: Found Spy Cookie: kmpads cookie 3:48 PM: justin@kmpads[1].txt (ID = 2909) 3:48 PM: Found Spy Cookie: domainsponsor cookie 3:48 PM: [removed][1].txt (ID = 2535) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: Found Spy Cookie: pricegrabber cookie 3:48 PM: [removed][1].txt (ID = 3186) 3:48 PM: Found Spy Cookie: metareward.com cookie 3:48 PM: justin@metareward[1].txt (ID = 2990) 3:48 PM: justin@microsofteup.112.2o7[1].txt (ID = 1958) 3:48 PM: justin@microsoftuk.122.2o7[1].txt (ID = 1958) 3:48 PM: [removed][1].txt (ID = 3566) 3:48 PM: justin@msnportal.112.2o7[1].txt (ID = 1958) 3:48 PM: justin@nasdaq.122.2o7[1].txt (ID = 1958) 3:48 PM: Found Spy Cookie: nextag cookie 3:48 PM: justin@nextag[1].txt (ID = 5014) 3:48 PM: Found Spy Cookie: offeroptimizer cookie 3:48 PM: justin@offeroptimizer[1].txt (ID = 3087) 3:48 PM: [removed][1].txt (ID = 3567) 3:48 PM: Found Spy Cookie: partypoker cookie 3:48 PM: justin@partypoker[1].txt (ID = 3111) 3:48 PM: Found Spy Cookie: passion cookie 3:48 PM: justin@passion[1].txt (ID = 3113) 3:48 PM: [removed][1].txt (ID = 3186) 3:48 PM: Found Spy Cookie: overture cookie 3:48 PM: [removed][1].txt (ID = 3106) 3:48 PM: [removed][2].txt (ID = 2632) 3:48 PM: justin@pricegrabber[1].txt (ID = 3185) 3:48 PM: Found Spy Cookie: questionmarket cookie 3:48 PM: justin@questionmarket[1].txt (ID = 3217) 3:48 PM: [removed][1].txt (ID = 2528) 3:48 PM: Found Spy Cookie: realmedia cookie 3:48 PM: justin@realmedia[1].txt (ID = 3235) 3:48 PM: Found Spy Cookie: reunion cookie 3:48 PM: justin@reunion[1].txt (ID = 3255) 3:48 PM: Found Spy Cookie: rn11 cookie 3:48 PM: justin@rn11[2].txt (ID = 3261) 3:48 PM: [removed][1].txt (ID = 2729) 3:48 PM: [removed][1].txt (ID = 2729) 3:48 PM: [removed][1].txt (ID = 2650) 3:48 PM: [removed][2].txt (ID = 2650) 3:48 PM: justin@sonycorporate.122.2o7[1].txt (ID = 1958) 3:48 PM: Found Spy Cookie: dealtime cookie 3:48 PM: [removed][2].txt (ID = 2506) 3:48 PM: Found Spy Cookie: reliablestats cookie 3:48 PM: [removed][1].txt (ID = 3254) 3:48 PM: Found Spy Cookie: clicktracks cookie 3:48 PM: [removed][2].txt (ID = 2407) 3:48 PM: Found Spy Cookie: tracking cookie 3:48 PM: justin@tracking[2].txt (ID = 3571) 3:48 PM: Found Spy Cookie: tradedoubler cookie 3:48 PM: justin@tradedoubler[2].txt (ID = 3575) 3:48 PM: Found Spy Cookie: trafficmp cookie 3:48 PM: justin@trafficmp[2].txt (ID = 3581) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: Found Spy Cookie: burstbeacon cookie 3:48 PM: [removed][1].txt (ID = 2335) 3:48 PM: Found Spy Cookie: myaffiliateprogram.com cookie 3:48 PM: [removed][2].txt (ID = 3032) 3:48 PM: Found Spy Cookie: web-stat cookie 3:48 PM: [removed]-stat[1].txt (ID = 3649) 3:48 PM: Found Spy Cookie: seeq cookie 3:48 PM: [removed][1].txt (ID = 3332) 3:48 PM: Found Spy Cookie: xiti cookie 3:48 PM: justin@xiti[1].txt (ID = 3717) 3:48 PM: justin@yieldmanager[1].txt (ID = 3749) 3:48 PM: Cookie Sweep Complete, Elapsed Time: 00:01:30 3:48 PM: Starting File Sweep 5:08 PM: File Sweep Complete, Elapsed Time: 01:19:53 5:08 PM: Full Sweep has completed. Elapsed time 01:52:31 5:08 PM: Traces Found: 108 5:34 PM: Removal process initiated 5:38 PM: Quarantining All Traces: virtumonde 5:38 PM: virtumonde is in use. It will be removed on reboot. 5:38 PM: C:\WINDOWS\system32\rqopp.dll is in use. It will be removed on reboot. 5:38 PM: Quarantining All Traces: trustyhound toolbar 5:38 PM: Quarantining All Traces: 2o7.net cookie 5:38 PM: Quarantining All Traces: 360i cookie 5:38 PM: Quarantining All Traces: aa cookie 5:38 PM: Quarantining All Traces: about cookie 5:38 PM: Quarantining All Traces: adknowledge cookie 5:38 PM: Quarantining All Traces: adlegend cookie 5:38 PM: Quarantining All Traces: adorigin cookie 5:38 PM: Quarantining All Traces: adrevolver cookie 5:38 PM: Quarantining All Traces: ad-rotator cookie 5:38 PM: Quarantining All Traces: ads.businessweek cookie 5:38 PM: Quarantining All Traces: ask cookie 5:38 PM: Quarantining All Traces: atwola cookie 5:38 PM: Quarantining All Traces: azjmp cookie 5:38 PM: Quarantining All Traces: banner cookie 5:38 PM: Quarantining All Traces: bannerspace cookie 5:38 PM: Quarantining All Traces: belnk cookie 5:38 PM: Quarantining All Traces: bizrate cookie 5:38 PM: Quarantining All Traces: burstbeacon cookie 5:38 PM: Quarantining All Traces: burstnet cookie 5:38 PM: Quarantining All Traces: callwave cookie 5:38 PM: Quarantining All Traces: casalemedia cookie 5:38 PM: Quarantining All Traces: centrport net cookie 5:38 PM: Quarantining All Traces: clickandtrack cookie 5:38 PM: Quarantining All Traces: clicktracks cookie 5:38 PM: Quarantining All Traces: consumerfreedom.com cookie 5:38 PM: Quarantining All Traces: customer cookie 5:38 PM: Quarantining All Traces: dealtime cookie 5:38 PM: Quarantining All Traces: did-it cookie 5:38 PM: Quarantining All Traces: directtrack cookie 5:38 PM: Quarantining All Traces: domainsponsor cookie 5:38 PM: Quarantining All Traces: experclick cookie 5:38 PM: Quarantining All Traces: falkag cookie 5:38 PM: Quarantining All Traces: gamespy cookie 5:38 PM: Quarantining All Traces: go.com cookie 5:38 PM: Quarantining All Traces: go2net.com cookie 5:38 PM: Quarantining All Traces: gostats cookie 5:38 PM: Quarantining All Traces: hbmediapro cookie 5:38 PM: Quarantining All Traces: howstuffworks cookie 5:38 PM: Quarantining All Traces: hypertracker.com cookie 5:38 PM: Quarantining All Traces: ic-live cookie 5:39 PM: Quarantining All Traces: kmpads cookie 5:39 PM: Quarantining All Traces: metareward.com cookie 5:39 PM: Quarantining All Traces: myaffiliateprogram.com cookie 5:39 PM: Quarantining All Traces: nextag cookie 5:39 PM: Quarantining All Traces: offeroptimizer cookie 5:39 PM: Quarantining All Traces: overture cookie 5:39 PM: Quarantining All Traces: partypoker cookie 5:39 PM: Quarantining All Traces: passion cookie 5:39 PM: Quarantining All Traces: pointroll cookie 5:39 PM: Quarantining All Traces: precisead cookie 5:39 PM: Quarantining All Traces: pricegrabber cookie 5:39 PM: Quarantining All Traces: questionmarket cookie 5:39 PM: Quarantining All Traces: realmedia cookie 5:39 PM: Quarantining All Traces: reliablestats cookie 5:39 PM: Quarantining All Traces: reunion cookie 5:39 PM: Quarantining All Traces: rn11 cookie 5:39 PM: Quarantining All Traces: ru4 cookie 5:39 PM: Quarantining All Traces: seeq cookie 5:39 PM: Quarantining All Traces: specificclick.com cookie 5:39 PM: Quarantining All Traces: touchclarity cookie 5:39 PM: Quarantining All Traces: tracking cookie 5:39 PM: Quarantining All Traces: tradedoubler cookie 5:39 PM: Quarantining All Traces: trafficmp cookie 5:39 PM: Quarantining All Traces: websponsors cookie 5:39 PM: Quarantining All Traces: web-stat cookie 5:39 PM: Quarantining All Traces: xiti cookie 5:39 PM: Quarantining All Traces: yieldmanager cookie 5:39 PM: Preparing to restart your computer. Please wait… 5:39 PM: Removal process completed. Elapsed time 00:04:34 5:54 PM: Common Ad Sites Shield is activated ******** 3:09 PM: | Start of Session, Saturday, November 19, 2005 | 3:09 PM: Spy Sweeper started 3:14 PM: Your spyware definitions have been updated. 3:15 PM: Updating spyware definitions 3:15 PM: Your definitions are up to date. 3:16 PM: | End of Session, Saturday, November 19, 2005 |
Post #7
I did, here it is again ******** 3:16 PM: | Start of Session, Saturday, November 19, 2005 | 3:16 PM: Spy Sweeper started 3:16 PM: Sweep initiated using definitions version 574 3:16 PM: Starting Memory Sweep 3:22 PM: Found Adware: virtumonde 3:22 PM: Detected running threat: C:\WINDOWS\system32\rqopp.dll (ID = 77) 3:42 PM: Memory Sweep Complete, Elapsed Time: 00:26:21 3:42 PM: Starting Registry Sweep 3:45 PM: Found Adware: trustyhound toolbar 3:45 PM: HKU\S-1-5-21-1056472089-4241767241-527367138-1005\software\xbtb01786\ (1 subtraces) (ID = 145197) 3:46 PM: Registry Sweep Complete, Elapsed Time:00:04:14 3:46 PM: Starting Cookie Sweep 3:47 PM: Found Spy Cookie: 2o7.net cookie 3:47 PM: justin@112.2o7[2].txt (ID = 1958) 3:47 PM: justin@2o7[2].txt (ID = 1957) 3:47 PM: Found Spy Cookie: websponsors cookie 3:47 PM: [removed][1].txt (ID = 3665) 3:47 PM: Found Spy Cookie: aa cookie 3:47 PM: justin@aa[2].txt (ID = 2029) 3:47 PM: Found Spy Cookie: go.com cookie 3:47 PM: [removed][2].txt (ID = 2729) 3:47 PM: [removed][2].txt (ID = 2729) 3:47 PM: Found Spy Cookie: about cookie 3:47 PM: justin@about[2].txt (ID = 2037) 3:47 PM: Found Spy Cookie: ad-rotator cookie 3:47 PM: justin@ad-rotator[1].txt (ID = 2051) 3:47 PM: Found Spy Cookie: yieldmanager cookie 3:47 PM: [removed][2].txt (ID = 3751) 3:47 PM: Found Spy Cookie: adknowledge cookie 3:47 PM: justin@adknowledge[1].txt (ID = 2072) 3:47 PM: Found Spy Cookie: adlegend cookie 3:47 PM: justin@adlegend[2].txt (ID = 2074) 3:47 PM: Found Spy Cookie: hbmediapro cookie 3:47 PM: [removed][2].txt (ID = 2768) 3:47 PM: Found Spy Cookie: precisead cookie 3:47 PM: [removed][1].txt (ID = 3182) 3:47 PM: Found Spy Cookie: specificclick.com cookie 3:47 PM: [removed][1].txt (ID = 3400) 3:47 PM: Found Spy Cookie: adorigin cookie 3:47 PM: justin@adorigin[2].txt (ID = 2082) 3:47 PM: Found Spy Cookie: adrevolver cookie 3:47 PM: justin@adrevolver[1].txt (ID = 2088) 3:47 PM: justin@adrevolver[3].txt (ID = 2088) 3:47 PM: Found Spy Cookie: ads.businessweek cookie 3:47 PM: [removed][1].txt (ID = 2113) 3:47 PM: Found Spy Cookie: pointroll cookie 3:47 PM: [removed][1].txt (ID = 3148) 3:47 PM: Found Spy Cookie: falkag cookie 3:47 PM: [removed][1].txt (ID = 2650) 3:47 PM: Found Spy Cookie: ask cookie 3:47 PM: justin@ask[1].txt (ID = 2245) 3:47 PM: Found Spy Cookie: belnk cookie 3:47 PM: [removed][1].txt (ID = 2293) 3:47 PM: Found Spy Cookie: atwola cookie 3:47 PM: justin@atwola[1].txt (ID = 2255) 3:47 PM: Found Spy Cookie: azjmp cookie 3:47 PM: justin@azjmp[2].txt (ID = 2270) 3:47 PM: Found Spy Cookie: bannerspace cookie 3:47 PM: justin@bannerspace[1].txt (ID = 2284) 3:47 PM: Found Spy Cookie: banner cookie 3:47 PM: justin@banner[2].txt (ID = 2276) 3:47 PM: justin@belnk[1].txt (ID = 2292) 3:47 PM: Found Spy Cookie: bizrate cookie 3:47 PM: justin@bizrate[2].txt (ID = 2308) 3:47 PM: Found Spy Cookie: touchclarity cookie 3:47 PM: [removed][1].txt (ID = 3566) 3:47 PM: Found Spy Cookie: burstnet cookie 3:47 PM: justin@burstnet[2].txt (ID = 2336) 3:47 PM: justin@buycom.122.2o7[1].txt (ID = 1958) 3:47 PM: Found Spy Cookie: gostats cookie 3:47 PM: [removed][2].txt (ID = 2748) 3:47 PM: Found Spy Cookie: callwave cookie 3:47 PM: justin@callwave[2].txt (ID = 2342) 3:47 PM: justin@cartoonnetwork.122.2o7[1].txt (ID = 1958) 3:47 PM: Found Spy Cookie: casalemedia cookie 3:47 PM: justin@casalemedia[2].txt (ID = 2354) 3:47 PM: Found Spy Cookie: centrport net cookie 3:47 PM: justin@centrport[2].txt (ID = 2374) 3:47 PM: [removed][1].txt (ID = 2038) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: Found Spy Cookie: consumerfreedom.com cookie 3:48 PM: justin@consumerfreedom[2].txt (ID = 2459) 3:48 PM: Found Spy Cookie: 360i cookie 3:48 PM: justin@ct.360i[1].txt (ID = 1962) 3:48 PM: Found Spy Cookie: customer cookie 3:48 PM: justin@customer[1].txt (ID = 2481) 3:48 PM: justin@customer[2].txt (ID = 2481) 3:48 PM: Found Spy Cookie: did-it cookie 3:48 PM: justin@did-it[2].txt (ID = 2523) 3:48 PM: justin@digitalhomediscountptyltd.122.2o7[2].txt (ID = 1958) 3:48 PM: Found Spy Cookie: directtrack cookie 3:48 PM: justin@directtrack[1].txt (ID = 2527) 3:48 PM: [removed][2].txt (ID = 2293) 3:48 PM: Found Spy Cookie: ru4 cookie 3:48 PM: justin@edge.ru4[1].txt (ID = 3269) 3:48 PM: [removed][2].txt (ID = 2038) 3:48 PM: Found Spy Cookie: excite cookie 3:48 PM: justin@excite[2].txt (ID = 2631) 3:48 PM: [removed][2].txt (ID = 2038) 3:48 PM: Found Spy Cookie: experclick cookie 3:48 PM: justin@experclick[1].txt (ID = 2639) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: [removed][2].txt (ID = 2038) 3:48 PM: Found Spy Cookie: gamespy cookie 3:48 PM: justin@gamespy[1].txt (ID = 2719) 3:48 PM: Found Spy Cookie: go2net.com cookie 3:48 PM: justin@go2net[1].txt (ID = 2730) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: justin@gostats[1].txt (ID = 2747) 3:48 PM: justin@go[2].txt (ID = 2728) 3:48 PM: Found Spy Cookie: clickandtrack cookie 3:48 PM: [removed][1].txt (ID = 2397) 3:48 PM: Found Spy Cookie: howstuffworks cookie 3:48 PM: justin@howstuffworks[1].txt (ID = 2805) 3:48 PM: Found Spy Cookie: hypertracker.com cookie 3:48 PM: justin@hypertracker[1].txt (ID = 2817) 3:48 PM: Found Spy Cookie: ic-live cookie 3:48 PM: justin@ic-live[1].txt (ID = 2821) 3:48 PM: Found Spy Cookie: kmpads cookie 3:48 PM: justin@kmpads[1].txt (ID = 2909) 3:48 PM: Found Spy Cookie: domainsponsor cookie 3:48 PM: [removed][1].txt (ID = 2535) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: Found Spy Cookie: pricegrabber cookie 3:48 PM: [removed][1].txt (ID = 3186) 3:48 PM: Found Spy Cookie: metareward.com cookie 3:48 PM: justin@metareward[1].txt (ID = 2990) 3:48 PM: justin@microsofteup.112.2o7[1].txt (ID = 1958) 3:48 PM: justin@microsoftuk.122.2o7[1].txt (ID = 1958) 3:48 PM: [removed][1].txt (ID = 3566) 3:48 PM: justin@msnportal.112.2o7[1].txt (ID = 1958) 3:48 PM: justin@nasdaq.122.2o7[1].txt (ID = 1958) 3:48 PM: Found Spy Cookie: nextag cookie 3:48 PM: justin@nextag[1].txt (ID = 5014) 3:48 PM: Found Spy Cookie: offeroptimizer cookie 3:48 PM: justin@offeroptimizer[1].txt (ID = 3087) 3:48 PM: [removed][1].txt (ID = 3567) 3:48 PM: Found Spy Cookie: partypoker cookie 3:48 PM: justin@partypoker[1].txt (ID = 3111) 3:48 PM: Found Spy Cookie: passion cookie 3:48 PM: justin@passion[1].txt (ID = 3113) 3:48 PM: [removed][1].txt (ID = 3186) 3:48 PM: Found Spy Cookie: overture cookie 3:48 PM: [removed][1].txt (ID = 3106) 3:48 PM: [removed][2].txt (ID = 2632) 3:48 PM: justin@pricegrabber[1].txt (ID = 3185) 3:48 PM: Found Spy Cookie: questionmarket cookie 3:48 PM: justin@questionmarket[1].txt (ID = 3217) 3:48 PM: [removed][1].txt (ID = 2528) 3:48 PM: Found Spy Cookie: realmedia cookie 3:48 PM: justin@realmedia[1].txt (ID = 3235) 3:48 PM: Found Spy Cookie: reunion cookie 3:48 PM: justin@reunion[1].txt (ID = 3255) 3:48 PM: Found Spy Cookie: rn11 cookie 3:48 PM: justin@rn11[2].txt (ID = 3261) 3:48 PM: [removed][1].txt (ID = 2729) 3:48 PM: [removed][1].txt (ID = 2729) 3:48 PM: [removed][1].txt (ID = 2650) 3:48 PM: [removed][2].txt (ID = 2650) 3:48 PM: justin@sonycorporate.122.2o7[1].txt (ID = 1958) 3:48 PM: Found Spy Cookie: dealtime cookie 3:48 PM: [removed][2].txt (ID = 2506) 3:48 PM: Found Spy Cookie: reliablestats cookie 3:48 PM: [removed][1].txt (ID = 3254) 3:48 PM: Found Spy Cookie: clicktracks cookie 3:48 PM: [removed][2].txt (ID = 2407) 3:48 PM: Found Spy Cookie: tracking cookie 3:48 PM: justin@tracking[2].txt (ID = 3571) 3:48 PM: Found Spy Cookie: tradedoubler cookie 3:48 PM: justin@tradedoubler[2].txt (ID = 3575) 3:48 PM: Found Spy Cookie: trafficmp cookie 3:48 PM: justin@trafficmp[2].txt (ID = 3581) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: [removed][1].txt (ID = 2038) 3:48 PM: Found Spy Cookie: burstbeacon cookie 3:48 PM: [removed][1].txt (ID = 2335) 3:48 PM: Found Spy Cookie: myaffiliateprogram.com cookie 3:48 PM: [removed][2].txt (ID = 3032) 3:48 PM: Found Spy Cookie: web-stat cookie 3:48 PM: [removed]-stat[1].txt (ID = 3649) 3:48 PM: Found Spy Cookie: seeq cookie 3:48 PM: [removed][1].txt (ID = 3332) 3:48 PM: Found Spy Cookie: xiti cookie 3:48 PM: justin@xiti[1].txt (ID = 3717) 3:48 PM: justin@yieldmanager[1].txt (ID = 3749) 3:48 PM: Cookie Sweep Complete, Elapsed Time: 00:01:30 3:48 PM: Starting File Sweep 5:08 PM: File Sweep Complete, Elapsed Time: 01:19:53 5:08 PM: Full Sweep has completed. Elapsed time 01:52:31 5:08 PM: Traces Found: 108 5:34 PM: Removal process initiated 5:38 PM: Quarantining All Traces: virtumonde 5:38 PM: virtumonde is in use. It will be removed on reboot. 5:38 PM: C:\WINDOWS\system32\rqopp.dll is in use. It will be removed on reboot. 5:38 PM: Quarantining All Traces: trustyhound toolbar 5:38 PM: Quarantining All Traces: 2o7.net cookie 5:38 PM: Quarantining All Traces: 360i cookie 5:38 PM: Quarantining All Traces: aa cookie 5:38 PM: Quarantining All Traces: about cookie 5:38 PM: Quarantining All Traces: adknowledge cookie 5:38 PM: Quarantining All Traces: adlegend cookie 5:38 PM: Quarantining All Traces: adorigin cookie 5:38 PM: Quarantining All Traces: adrevolver cookie 5:38 PM: Quarantining All Traces: ad-rotator cookie 5:38 PM: Quarantining All Traces: ads.businessweek cookie 5:38 PM: Quarantining All Traces: ask cookie 5:38 PM: Quarantining All Traces: atwola cookie 5:38 PM: Quarantining All Traces: azjmp cookie 5:38 PM: Quarantining All Traces: banner cookie 5:38 PM: Quarantining All Traces: bannerspace cookie 5:38 PM: Quarantining All Traces: belnk cookie 5:38 PM: Quarantining All Traces: bizrate cookie 5:38 PM: Quarantining All Traces: burstbeacon cookie 5:38 PM: Quarantining All Traces: burstnet cookie 5:38 PM: Quarantining All Traces: callwave cookie 5:38 PM: Quarantining All Traces: casalemedia cookie 5:38 PM: Quarantining All Traces: centrport net cookie 5:38 PM: Quarantining All Traces: clickandtrack cookie 5:38 PM: Quarantining All Traces: clicktracks cookie 5:38 PM: Quarantining All Traces: consumerfreedom.com cookie 5:38 PM: Quarantining All Traces: customer cookie 5:38 PM: Quarantining All Traces: dealtime cookie 5:38 PM: Quarantining All Traces: did-it cookie 5:38 PM: Quarantining All Traces: directtrack cookie 5:38 PM: Quarantining All Traces: domainsponsor cookie 5:38 PM: Quarantining All Traces: experclick cookie 5:38 PM: Quarantining All Traces: falkag cookie 5:38 PM: Quarantining All Traces: gamespy cookie 5:38 PM: Quarantining All Traces: go.com cookie 5:38 PM: Quarantining All Traces: go2net.com cookie 5:38 PM: Quarantining All Traces: gostats cookie 5:38 PM: Quarantining All Traces: hbmediapro cookie 5:38 PM: Quarantining All Traces: howstuffworks cookie 5:38 PM: Quarantining All Traces: hypertracker.com cookie 5:38 PM: Quarantining All Traces: ic-live cookie 5:39 PM: Quarantining All Traces: kmpads cookie 5:39 PM: Quarantining All Traces: metareward.com cookie 5:39 PM: Quarantining All Traces: myaffiliateprogram.com cookie 5:39 PM: Quarantining All Traces: nextag cookie 5:39 PM: Quarantining All Traces: offeroptimizer cookie 5:39 PM: Quarantining All Traces: overture cookie 5:39 PM: Quarantining All Traces: partypoker cookie 5:39 PM: Quarantining All Traces: passion cookie 5:39 PM: Quarantining All Traces: pointroll cookie 5:39 PM: Quarantining All Traces: precisead cookie 5:39 PM: Quarantining All Traces: pricegrabber cookie 5:39 PM: Quarantining All Traces: questionmarket cookie 5:39 PM: Quarantining All Traces: realmedia cookie 5:39 PM: Quarantining All Traces: reliablestats cookie 5:39 PM: Quarantining All Traces: reunion cookie 5:39 PM: Quarantining All Traces: rn11 cookie 5:39 PM: Quarantining All Traces: ru4 cookie 5:39 PM: Quarantining All Traces: seeq cookie 5:39 PM: Quarantining All Traces: specificclick.com cookie 5:39 PM: Quarantining All Traces: touchclarity cookie 5:39 PM: Quarantining All Traces: tracking cookie 5:39 PM: Quarantining All Traces: tradedoubler cookie 5:39 PM: Quarantining All Traces: trafficmp cookie 5:39 PM: Quarantining All Traces: websponsors cookie 5:39 PM: Quarantining All Traces: web-stat cookie 5:39 PM: Quarantining All Traces: xiti cookie 5:39 PM: Quarantining All Traces: yieldmanager cookie 5:39 PM: Preparing to restart your computer. Please wait… 5:39 PM: Removal process completed. Elapsed time 00:04:34 5:54 PM: Common Ad Sites Shield is activated ******** 3:09 PM: | Start of Session, Saturday, November 19, 2005 | 3:09 PM: Spy Sweeper started 3:14 PM: Your spyware definitions have been updated. 3:15 PM: Updating spyware definitions 3:15 PM: Your definitions are up to date. 3:16 PM: | End of Session, Saturday, November 19, 2005 |

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI