Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93099 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Security Alerts and Winfixer 2005 pop ups


  • This topic is locked This topic is locked
13 replies to this topic

#1 summer284

summer284

    New Member

  • New Member
  • Pip
  • 7 posts

Posted 17 December 2005 - 06:13 PM

I have the Winfixer 2005 pop up trojan and its enough to drive you crazy. I get Security Alerts saying "The security certificate is issued from a company you not chosen to trust". And lately I have been getting lots of pop ups. So between the security alerts and the pop up, its driving me crazy. I have gone into Tools, Internet Options, Security and the website that gives me security alerts is not in my restricted site. I have even included it in my Trusted Site. In my Tool, Internet Options, Content, When I click Certificate. I have the tabs Personal, Other People, Intermediate Certification Authorities, Trusted Root Certification Authorities. I have arrowed over and those are all the tabs I have, none more are hidden.

I have ran spybot, adaware, xoftsypy. None of these seem to work

Here is my log from Hijack This, Any help would be greatly appreciated.

Thanks

Logfile of HijackThis v1.99.1
Scan saved at 5:38:36 PM, on 17/12/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - C:\PROGRA~1\ZEROPO~1\ZERO-P~1.DLL
O2 - BHO: ATLDistrib Object - {7A1A109F-58B3-414B-9829-5F4D9BE5FEDE} - C:\WINDOWS\SYSTEM\EFEDA.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunOnce: [*EFEDA] rundll32.exe C:\WINDOWS\SYSTEM\EFEDA.DLL,CreateProtectProc rerun
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PROGRAM FILES\PARTYPOKER\IEEXTENSION.DLL
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PROGRAM FILES\PARTYPOKER\IEEXTENSION.DLL
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Shaw Help - {C74D011F-7BCC-441A-B871-AC7817CB9B90} - http://support.shaw.ca (file missing) (HKCU)
O9 - Extra button: GooGle - {D7AEB2C9-9F00-4CD5-A173-AF67AA4F4877} - http://www.google.ca (file missing) (HKCU)
O9 - Extra button: WebMail - {8DFCB8CA-10AD-4955-888F-A23211529E32} - https://webmail.shaw.ca (file missing) (HKCU)
O9 - Extra button: eBay - {31F89B98-4F65-4866-8F3E-53DFD669AA46} - http://www.ebay.com (file missing) (HKCU)
O9 - Extra button: SOD - {72583D76-270D-41B1-BA4A-1619E8DF2E58} - http://www.shawondemand.ca (file missing) (HKCU)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c...ials/ymmapi.dll
O16 - DPF: Yahoo! Cribbage - http://download.game...nts/y/it0_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/p...t/msnchat45.cab
O16 - DPF: Yahoo! Go - http://download.game...nts/y/gt1_x.cab
O16 - DPF: Tornado 21 - http://download.game...s/y/t21t0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.s...og/y/fs10_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct2_x.cab
O16 - DPF: Video Poker - http://download.game...ts/y/vpt0_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.game...ts/y/ywt0_x.cab
O16 - DPF: Yahoo! Exploder - http://download.game...nts/y/vtk_x.cab
O16 - DPF: ChatSpace Full Java Client 4.0.0.300 - http://63.102.226.24...va/cfs40300.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zon...oF.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab

    Advertisements

Register to Remove


#2 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 17 December 2005 - 07:26 PM

Hello summer284, welcome to the TC.


I suggest you do this:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

O2 - BHO: ATLDistrib Object - {7A1A109F-58B3-414B-9829-5F4D9BE5FEDE} - C:\WINDOWS\SYSTEM\EFEDA.DLL

O4 - HKLM\..\RunOnce: [*EFEDA] rundll32.exe C:\WINDOWS\SYSTEM\EFEDA.DLL,CreateProtectProc rerun

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PROGRAM FILES\PARTYPOKER\IEEXTENSION.DLL

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PROGRAM FILES\PARTYPOKER\IEEXTENSION.DLL


Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete these Files if listed:
C:\WINDOWS\SYSTEM\EFEDA.DLL


1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#3 summer284

summer284

    New Member

  • New Member
  • Pip
  • 7 posts

Posted 17 December 2005 - 08:26 PM

When I restarted my computer, Windows Explore would not load, the screen was blue, I did Ctl, Alt, Delete and it had Explorer (not responding).

I hit Ctl, Alt, Delete to restart and this time it started up. After it started up I got the security alert and I hit yes to proceed and it directed me to
http://www.winfixer....h_6,5&lid=keyin

I closed the site and ran Hijack again. Here is the new log





Logfile of HijackThis v1.99.1
Scan saved at 8:18:12 PM, on 17/12/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - C:\PROGRA~1\ZEROPO~1\ZERO-P~1.DLL
O2 - BHO: ATLDistrib Object - {7A1A109F-58B3-414B-9829-5F4D9BE5FEDE} - C:\WINDOWS\SYSTEM\EFEDA.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunOnce: [*EFEDA] rundll32.exe C:\WINDOWS\SYSTEM\EFEDA.DLL,CreateProtectProc rerun
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Shaw Help - {C74D011F-7BCC-441A-B871-AC7817CB9B90} - http://support.shaw.ca (file missing) (HKCU)
O9 - Extra button: GooGle - {D7AEB2C9-9F00-4CD5-A173-AF67AA4F4877} - http://www.google.ca (file missing) (HKCU)
O9 - Extra button: WebMail - {8DFCB8CA-10AD-4955-888F-A23211529E32} - https://webmail.shaw.ca (file missing) (HKCU)
O9 - Extra button: eBay - {31F89B98-4F65-4866-8F3E-53DFD669AA46} - http://www.ebay.com (file missing) (HKCU)
O9 - Extra button: SOD - {72583D76-270D-41B1-BA4A-1619E8DF2E58} - http://www.shawondemand.ca (file missing) (HKCU)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c...ials/ymmapi.dll
O16 - DPF: Yahoo! Cribbage - http://download.game...nts/y/it0_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/p...t/msnchat45.cab
O16 - DPF: Yahoo! Go - http://download.game...nts/y/gt1_x.cab
O16 - DPF: Tornado 21 - http://download.game...s/y/t21t0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.s...og/y/fs10_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct2_x.cab
O16 - DPF: Video Poker - http://download.game...ts/y/vpt0_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.game...ts/y/ywt0_x.cab
O16 - DPF: Yahoo! Exploder - http://download.game...nts/y/vtk_x.cab
O16 - DPF: ChatSpace Full Java Client 4.0.0.300 - http://63.102.226.24...va/cfs40300.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zon...oF.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab

#4 summer284

summer284

    New Member

  • New Member
  • Pip
  • 7 posts

Posted 17 December 2005 - 08:33 PM

In your instruction you wrote Delete these files if listed C:\Windows\System\EFEDA.DLL Do you mean go to my computer in the C drive and delete or off of Hijack.

#5 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 17 December 2005 - 08:36 PM

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#6 summer284

summer284

    New Member

  • New Member
  • Pip
  • 7 posts

Posted 17 December 2005 - 10:26 PM

Followed instructions, when i rebooted it workd fine except I got a message saying
windows could not find file C\Windows\System\EFEDA.DLL

Here is my new log for Hijack and my results from Sweep Options.

Thank you very much for your help. I really appreciate you helping me. I will read your post tomorrow
as I am going to bed (long day). Talk to you tomorrow.


Logfile of HijackThis v1.99.1
Scan saved at 10:18:42 PM, on 17/12/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - C:\PROGRA~1\ZEROPO~1\ZERO-P~1.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Shaw Help - {C74D011F-7BCC-441A-B871-AC7817CB9B90} - http://support.shaw.ca (file missing) (HKCU)
O9 - Extra button: GooGle - {D7AEB2C9-9F00-4CD5-A173-AF67AA4F4877} - http://www.google.ca (file missing) (HKCU)
O9 - Extra button: WebMail - {8DFCB8CA-10AD-4955-888F-A23211529E32} - https://webmail.shaw.ca (file missing) (HKCU)
O9 - Extra button: eBay - {31F89B98-4F65-4866-8F3E-53DFD669AA46} - http://www.ebay.com (file missing) (HKCU)
O9 - Extra button: SOD - {72583D76-270D-41B1-BA4A-1619E8DF2E58} - http://www.shawondemand.ca (file missing) (HKCU)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c...ials/ymmapi.dll
O16 - DPF: Yahoo! Cribbage - http://download.game...nts/y/it0_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/p...t/msnchat45.cab
O16 - DPF: Yahoo! Go - http://download.game...nts/y/gt1_x.cab
O16 - DPF: Tornado 21 - http://download.game...s/y/t21t0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.s...og/y/fs10_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct2_x.cab
O16 - DPF: Video Poker - http://download.game...ts/y/vpt0_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.game...ts/y/ywt0_x.cab
O16 - DPF: Yahoo! Exploder - http://download.game...nts/y/vtk_x.cab
O16 - DPF: ChatSpace Full Java Client 4.0.0.300 - http://63.102.226.24...va/cfs40300.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zon...oF.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab



RESULTS FOR SWEEP OPTIONS

9:03 PM: | Start of Session, December 17, 2005 |
9:03 PM: Spy Sweeper started
9:03 PM: Sweep initiated using definitions version 586
9:03 PM: Starting Memory Sweep
9:08 PM: Found Adware: virtumonde
9:08 PM: Detected running threat: C:\WINDOWS\SYSTEM\efeda.dll (ID = 77)
9:10 PM: Memory Sweep Complete, Elapsed Time: 00:06:28
9:10 PM: Starting Registry Sweep
9:10 PM: Found Adware: adlogix
9:10 PM: HKCR\interface\{2bdb4da9-94fe-4034-aac5-ceecdcb3a33b}\ (8 subtraces) (ID = 102893)
9:10 PM: HKCR\interface\{4d8e41a8-ec1f-4c53-a10d-9120232c71bb}\ (8 subtraces) (ID = 102894)
9:10 PM: HKLM\software\classes\interface\{2bdb4da9-94fe-4034-aac5-ceecdcb3a33b}\ (8 subtraces) (ID = 103008)
9:10 PM: HKLM\software\classes\interface\{4d8e41a8-ec1f-4c53-a10d-9120232c71bb}\ (8 subtraces) (ID = 103009)
9:10 PM: Found Adware: adultlinks
9:10 PM: HKCR\adultbar.adultbar.1\ (3 subtraces) (ID = 103255)
9:10 PM: HKCR\adultbar.adultbar\ (5 subtraces) (ID = 103256)
9:10 PM: HKCR\adultsearch.adultsearch.1\ (3 subtraces) (ID = 103257)
9:10 PM: HKCR\adultsearch.adultsearch\ (5 subtraces) (ID = 103258)
9:10 PM: HKLM\software\classes\adultbar.adultbar.1\ (3 subtraces) (ID = 103279)
9:10 PM: HKLM\software\classes\adultbar.adultbar\ (5 subtraces) (ID = 103280)
9:10 PM: HKLM\software\classes\adultsearch.adultsearch.1\ (3 subtraces) (ID = 103281)
9:10 PM: HKLM\software\classes\adultsearch.adultsearch\ (5 subtraces) (ID = 103282)
9:10 PM: Found Adware: altnet
9:10 PM: HKLM\altnet\ (1 subtraces) (ID = 103447)
9:10 PM: Found Adware: blazefind
9:10 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/bridge.dll\ (2 subtraces) (ID = 104526)
9:11 PM: Found Adware: coolwebsearch (cws)
9:11 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/rundlg32.dll\ (2 subtraces) (ID = 112385)
9:12 PM: Found Adware: squire webhelper
9:12 PM: HKCR\typelib\{4d0ac936-bde8-4ea2-b4fb-9f89e5b4c186}\ (9 subtraces) (ID = 142154)
9:12 PM: HKLM\software\classes\typelib\{4d0ac936-bde8-4ea2-b4fb-9f89e5b4c186}\ (9 subtraces) (ID = 142175)
9:13 PM: Found Adware: websearch toolbar
9:13 PM: HKLM\software\microsoft\windows\currentversion\installer\userdata\aui\ (1 subtraces) (ID = 146479)
9:13 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/qdow.dll\ (2 subtraces) (ID = 146481)
9:13 PM: HKCR\atldistrib.atldistrib\ (5 subtraces) (ID = 1030533)
9:13 PM: HKCR\atldistrib.atldistrib\clsid\ (1 subtraces) (ID = 1030535)
9:13 PM: HKCR\atldistrib.atldistrib\curver\ (1 subtraces) (ID = 1030537)
9:13 PM: HKCR\atldistrib.atldistrib.1\ (3 subtraces) (ID = 1030539)
9:13 PM: HKCR\atldistrib.atldistrib.1\clsid\ (1 subtraces) (ID = 1030541)
9:13 PM: HKLM\software\classes\atldistrib.atldistrib\ (5 subtraces) (ID = 1030666)
9:13 PM: HKLM\software\classes\atldistrib.atldistrib\clsid\ (1 subtraces) (ID = 1030668)
9:13 PM: HKLM\software\classes\atldistrib.atldistrib\curver\ (1 subtraces) (ID = 1030670)
9:13 PM: HKLM\software\classes\atldistrib.atldistrib.1\ (3 subtraces) (ID = 1030672)
9:13 PM: HKLM\software\classes\atldistrib.atldistrib.1\clsid\ (1 subtraces) (ID = 1030674)
9:13 PM: Found System Monitor: klogger
9:13 PM: HKU\.DEFAULT\software\kaksoftstudio\ (6 subtraces) (ID = 129686)
9:14 PM: Registry Sweep Complete, Elapsed Time:00:03:48
9:14 PM: Starting Cookie Sweep
9:14 PM: Found Spy Cookie: reliablestats cookie
9:14 PM: anyuser@stats1.reliablestats[1].txt (ID = 3254)
9:14 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01
9:14 PM: Starting File Sweep
9:15 PM: Warning: Failed to open file "c:\windows\win386.swp". The process cannot access the file because it is being used by another process
9:15 PM: Found Adware: commonname
9:15 PM: cnbabeie.exe (ID = 53748)
9:15 PM: Found Adware: exact cashback/bargain buddy
9:15 PM: cdt_bbi8016.exe (ID = 50581)
9:20 PM: Warning: Failed to open file "c:\windows\system\c36bhs.dll". Access is denied
9:28 PM: Found Adware: directrevenue-abetterinternet
9:28 PM: biini.inf (ID = 83199)
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs889f45b5-a158-4775-ba28-9f9df8536f52.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsafb00b01-6dbb-4046-8cf1-2ebf7ec8b761.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs580824fe-16d1-44a2-a337-23386294bb8c.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf716bd36-bdc0-4c02-8381-34b79f84202e.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs817e8511-e423-4646-8346-23a205358070.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs10a77436-3679-4c06-8923-3d3af3a2f588.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs24e8d5e3-f9b3-4ab5-9590-749465e3940d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs91296ff9-8e1c-4ec9-8362-57428cb33b27.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs99934650-29cc-4198-ab4e-3b495432884d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse48407fa-ffce-4635-8e10-1cf0e09cd847.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf971820e-c9c1-416e-8ba5-5e11eb18630d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfb288abb-ffc7-4f0a-a429-7486578dea7c.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1950fddb-583d-40d8-9a7b-06b94448e2b2.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsee929a93-8fb0-4ba7-95d8-1f7aa7a3bdbd.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs65d5518d-dfb3-4e94-a4db-d689ac4dc6cb.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscf014a8b-249a-410e-af0b-bd6ffd37dc1b.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2c467ab0-4e1e-4fbe-9b6c-0a3b3aca43f7.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs700fda50-2072-4c33-aaa3-06e1c6d2fcbb.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs027146ad-8b8a-4a90-a0f1-8df7e64cbbf2.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa5b97150-d827-4238-b2d8-6dd98ae1ea84.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs33d46ddf-8fdc-45f8-8df2-047f95481988.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb79f0ff8-45b9-45cb-bb4f-067da5be4945.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs92b08257-4108-4b3b-9991-e842dd09ba78.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs83c644ce-6f11-4ccf-a87d-fdebcb3dc5ec.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsaf34720e-a2a0-4690-824e-6143c082eecb.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse342c65f-8165-4916-b188-e06e2579ced8.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs64f2f181-cd07-4a12-b9a9-b68702fcd709.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa61b869a-2858-4fc0-9851-78965674f639.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf028c5ff-2d73-40e7-bff2-b8c8653f87d3.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsbafdf913-2ace-4af3-9de2-6543f435393a.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1d19f89f-3f60-494c-a021-c92ef4eb5e6d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5909eb80-b2ef-46da-abed-9b87cb0911cb.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc27c4f16-8d9e-47d5-ad89-5f01888d2ab9.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8519825e-97b8-4bf7-9a28-1eac51807c0d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs91984f68-a0dd-412d-bad0-5f891d2f9a95.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs51c8f95b-fa07-479e-99a5-969eab454b47.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf85c6678-ba81-4e50-a1eb-b011815b93c9.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2edff283-b1c6-4f78-9568-9483e1010184.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfcc4e301-0c4c-4561-93a2-c0fa1b0266ea.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdc3ba10b-edea-4301-99d3-f31d4b14e318.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs41c2954b-a7d4-48c9-a5b3-6c373dd5bdbf.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0fbbb5d7-4ed9-422f-a38e-2023ce5965f7.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7e2b9337-2ca4-487e-b90b-4ce1194c9a5a.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs57ac8dee-c48a-4ae1-b9b0-24499a107532.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfcdb5f9d-75a3-47e0-b3ef-ebb558241090.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3d40c73e-96d7-4505-8be0-ad7615dc1df1.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1aaab845-a228-47a9-8a26-56b2afd73b71.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5ce7991f-9375-4430-9d05-ec9d3efdc34a.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs81e6dbb0-3d60-48d0-a2a2-68f189b4b02b.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs965c739b-6c7d-44a2-a47c-0f711208ea8e.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs93219fc0-84b6-45aa-8a00-58ad0fac9e29.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5bed0a50-7653-458d-86f2-22f15d7ba0f3.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9513f601-7ea2-426d-a9aa-fc0f6f70082c.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdf0c1b1c-f2f0-4c41-bc4e-921b667b549a.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1de9a2b1-5041-42f4-b447-d1dcd0cb3df9.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4db841e5-2978-4bce-8c71-4a2eb298afc2.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs571181a7-df4b-461a-84e4-0e7b36e3a18d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6dde549f-9f02-49de-b12c-1991226a4daf.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs37a46888-5aca-4423-9b6e-5f1ece606dd0.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd32c9ed5-f260-421c-8ebe-6a0886f51cce.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2df1f061-9543-4c69-9f99-47b0a5a34027.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1fbf0c7b-8505-4a2b-a08c-3fd6ad9ef0f5.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2e70e795-357d-4d51-8196-050f2dedd96a.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9f43517e-513c-4636-abde-d320ec324b9d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3e73a920-f9ce-4dea-b565-ccc024e4a225.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsbedc1b19-6780-4c97-81c7-fbce3c5578c4.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs32318950-d82d-40bf-8dfa-d775bf2ac470.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1ada69b9-b7f3-4621-bf2c-0b6eb2de98d3.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5087f358-4798-400d-86ba-9645cd6649a9.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs02d835ac-8486-4176-9246-d29984e24d13.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd2626505-c94f-4a26-b252-a56bd4acc8de.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa9989b51-06d7-44ae-98fb-0f1d5b7a7f8f.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4f07783c-d07b-46bf-ad41-3f9b9919f6be.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa51ba538-8133-4192-8e00-77f8c0f5fe2d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc8c90433-143d-46d6-ad9c-8bc0b3acc2a5.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa7b8bc63-665e-433c-bde2-ba600a6c1733.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7c1b6c56-e50d-4d09-a502-bdfda90f98df.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs49c4823d-1656-47ad-8d12-f6420a3a8aac.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc8f2827f-ce86-41a6-9f5c-c80194b51ddc.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3480a7f7-6c5a-47ce-ac88-e74095d7ac68.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb695070d-0fd2-4734-b277-53070f8b6cae.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4de1c50f-9a02-4f02-84a6-51ed6989d212.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs883beefb-85e0-4750-8eaf-c606cd81ca59.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7a6e525a-1f47-4f56-b295-e245e28ac8fb.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs38e75329-edd0-42d3-8bb2-854313b59906.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2fd2fb2c-1926-4cff-b3c0-240ce77677b0.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa5ef4945-0327-4b4f-ad4c-0d4ee855d74c.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1e4de7da-cbaa-4da5-81fe-2112d3ec0dfb.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs200ff6c9-3e2b-41c1-8b5c-10861d93b0b7.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb991781c-9ccf-473a-8f33-83e8c0f53166.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf1659a9d-1878-4c10-98ec-f51e607b551d.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs34a092cf-e0b7-4e05-b108-0f41a047e69e.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd87cee79-982a-4261-9c9f-e0eeb87c74c7.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsad348995-1bc1-408e-a1da-dd67c9bd37b1.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8c8a9e10-21f2-42ee-8952-34230a0e876c.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc2d67955-9cf5-40da-9d19-6f280e05b6a6.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0fcf7f6b-22b9-4020-a26c-9e86e79120be.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0d2c9da5-b60a-44fa-a3a8-a5e6f9eab00a.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3d3cf235-21b4-492d-ac1a-247b524d50b6.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5f58e396-8abc-4623-b596-94024fe58cae.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs49b63855-d37e-4bf1-996a-16b0074a0fc5.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs070e1f65-e1b2-451d-b891-b3390d3ea56a.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs398cf4ad-41df-4589-a7ea-b34b33d29c9b.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs96ccf6e7-70cf-4455-b72a-82397b7e7fdc.tmp". The process cannot access the file because it is being used by another process
9:30 PM: Found Adware: java byteverify
9:30 PM: dummy.class-1187a14c-33f6b625.class (ID = 64821)
9:37 PM: Found Adware: hiwire
9:37 PM: hwutils.dll (ID = 62165)
9:38 PM: Found Adware: winantispyware 2005
9:38 PM: c:\program files\common files\winsoftware (1 subtraces) (ID = -2147476682)
9:38 PM: crxml.dll (ID = 119203)
9:51 PM: Warning: Invalid Stream
9:51 PM: Warning: Invalid Stream
9:51 PM: Warning: Invalid Stream
10:03 PM: 20041121130256840.zip (ID = 83154)
10:03 PM: File Sweep Complete, Elapsed Time: 00:49:26
10:03 PM: Full Sweep has completed. Elapsed time 00:59:45
10:03 PM: Traces Found: 159
10:07 PM: Removal process initiated
10:07 PM: Quarantining All Traces: adlogix
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine adlogix
10:07 PM: Failed to quarantine interface\{2bdb4da9-94fe-4034-aac5-ceecdcb3a33b}\
10:07 PM: Failed to quarantine interface\{4d8e41a8-ec1f-4c53-a10d-9120232c71bb}\
10:07 PM: Failed to quarantine HKLM: software\classes\interface\{2bdb4da9-94fe-4034-aac5-ceecdcb3a33b}\
10:07 PM: Failed to quarantine HKLM: software\classes\interface\{4d8e41a8-ec1f-4c53-a10d-9120232c71bb}\
10:07 PM: Quarantining All Traces: directrevenue-abetterinternet
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine directrevenue-abetterinternet
10:07 PM: Failed to quarantine biini.inf
10:07 PM: Failed to quarantine 20041121130256840.zip
10:07 PM: Quarantining All Traces: klogger
10:07 PM: Quarantining All Traces: virtumonde
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine virtumonde
10:07 PM: Failed to quarantine atldistrib.atldistrib\
10:07 PM: Failed to quarantine atldistrib.atldistrib\clsid\
10:07 PM: Failed to quarantine atldistrib.atldistrib\curver\
10:07 PM: Failed to quarantine atldistrib.atldistrib.1\
10:07 PM: Failed to quarantine atldistrib.atldistrib.1\clsid\
10:07 PM: Failed to quarantine HKLM: software\classes\atldistrib.atldistrib\
10:07 PM: Failed to quarantine HKLM: software\classes\atldistrib.atldistrib\clsid\
10:07 PM: Failed to quarantine HKLM: software\classes\atldistrib.atldistrib\curver\
10:07 PM: Failed to quarantine HKLM: software\classes\atldistrib.atldistrib.1\
10:07 PM: Failed to quarantine HKLM: software\classes\atldistrib.atldistrib.1\clsid\
10:07 PM: Failed to quarantine C:\WINDOWS\SYSTEM\efeda.dll
10:07 PM: Quarantining All Traces: websearch toolbar
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine websearch toolbar
10:07 PM: Failed to quarantine HKLM: software\microsoft\windows\currentversion\installer\userdata\aui\
10:07 PM: Failed to quarantine HKLM: software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/qdow.dll\
10:07 PM: Quarantining All Traces: adultlinks
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine adultlinks
10:07 PM: Failed to quarantine adultbar.adultbar.1\
10:07 PM: Failed to quarantine adultbar.adultbar\
10:07 PM: Failed to quarantine adultsearch.adultsearch.1\
10:07 PM: Failed to quarantine adultsearch.adultsearch\
10:07 PM: Failed to quarantine HKLM: software\classes\adultbar.adultbar.1\
10:07 PM: Failed to quarantine HKLM: software\classes\adultbar.adultbar\
10:07 PM: Failed to quarantine HKLM: software\classes\adultsearch.adultsearch.1\
10:07 PM: Failed to quarantine HKLM: software\classes\adultsearch.adultsearch\
10:07 PM: Quarantining All Traces: blazefind
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine blazefind
10:07 PM: Failed to quarantine HKLM: software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/bridge.dll\
10:07 PM: Quarantining All Traces: commonname
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine commonname
10:07 PM: Failed to quarantine cnbabeie.exe
10:07 PM: Quarantining All Traces: coolwebsearch (cws)
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine coolwebsearch (cws)
10:07 PM: Failed to quarantine HKLM: software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/rundlg32.dll\
10:07 PM: Quarantining All Traces: squire webhelper
10:07 PM: Warning: Out of memory
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine squire webhelper
10:07 PM: Failed to quarantine typelib\{4d0ac936-bde8-4ea2-b4fb-9f89e5b4c186}\
10:07 PM: Failed to quarantine HKLM: software\classes\typelib\{4d0ac936-bde8-4ea2-b4fb-9f89e5b4c186}\
10:07 PM: Quarantining All Traces: altnet
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine altnet
10:07 PM: Failed to quarantine HKLM: altnet\
10:07 PM: Quarantining All Traces: exact cashback/bargain buddy
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine exact cashback/bargain buddy
10:07 PM: Failed to quarantine cdt_bbi8016.exe
10:07 PM: Quarantining All Traces: hiwire
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine hiwire
10:07 PM: Failed to quarantine hwutils.dll
10:07 PM: Quarantining All Traces: java byteverify
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine java byteverify
10:07 PM: Failed to quarantine dummy.class-1187a14c-33f6b625.class
10:07 PM: Quarantining All Traces: winantispyware 2005
10:07 PM: Warning: Out of memory
10:07 PM: Error: Out of memory.
10:07 PM: Failed to quarantine winantispyware 2005
10:07 PM: Failed to quarantine crxml.dll
10:07 PM: Quarantining All Traces: reliablestats cookie
10:07 PM: Warning: Out of memory
10:07 PM: Failed to quarantine reliablestats cookie
10:07 PM: Failed to quarantine anyuser@stats1.reliablestats[1].txt
10:07 PM: Warning: Launched explorer.exe
10:07 PM: Warning: Quarantine process could not restart Explorer.
10:07 PM: Warning: Out of memory
10:08 PM: Preparing to restart your computer. Please wait...
10:08 PM: Removal process completed. Elapsed time 00:01:38
10:12 PM: Sent error log: C:\WINDOWS\Application Data\Webroot\Spy Sweeper\Logs\bugreport.txt
********
9:01 PM: | Start of Session, December 17, 2005 |
9:01 PM: Spy Sweeper started
9:02 PM: Your spyware definitions have been updated.
9:03 PM: | End of Session, December 17, 2005 |

#7 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 18 December 2005 - 07:10 AM

You have quit a collection there.

Please download System Security Suite. Extract it from the zip file into a folder.
Run as illustrated here.


Next:
Now do another Spysweeper run.

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#8 summer284

summer284

    New Member

  • New Member
  • Pip
  • 7 posts

Posted 18 December 2005 - 01:51 PM

Here is my HJT Log and my spysweeper results.
After I emptied my recycle bin, I restarted my computer and it ran perfectly.
I also have had no other popups with winfixer.
Boy if you fixed my problem you are the smarter man I know.
Waiting your replay and thanking you so much

Logfile of HijackThis v1.99.1
Scan saved at 1:32:06 PM, on 18/12/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - C:\PROGRA~1\ZEROPO~1\ZERO-P~1.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Shaw Help - {C74D011F-7BCC-441A-B871-AC7817CB9B90} - http://support.shaw.ca (file missing) (HKCU)
O9 - Extra button: GooGle - {D7AEB2C9-9F00-4CD5-A173-AF67AA4F4877} - http://www.google.ca (file missing) (HKCU)
O9 - Extra button: WebMail - {8DFCB8CA-10AD-4955-888F-A23211529E32} - https://webmail.shaw.ca (file missing) (HKCU)
O9 - Extra button: eBay - {31F89B98-4F65-4866-8F3E-53DFD669AA46} - http://www.ebay.com (file missing) (HKCU)
O9 - Extra button: SOD - {72583D76-270D-41B1-BA4A-1619E8DF2E58} - http://www.shawondemand.ca (file missing) (HKCU)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c...ials/ymmapi.dll
O16 - DPF: Yahoo! Cribbage - http://download.game...nts/y/it0_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/p...t/msnchat45.cab
O16 - DPF: Yahoo! Go - http://download.game...nts/y/gt1_x.cab
O16 - DPF: Tornado 21 - http://download.game...s/y/t21t0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.s...og/y/fs10_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct2_x.cab
O16 - DPF: Video Poker - http://download.game...ts/y/vpt0_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.game...ts/y/ywt0_x.cab
O16 - DPF: Yahoo! Exploder - http://download.game...nts/y/vtk_x.cab
O16 - DPF: ChatSpace Full Java Client 4.0.0.300 - http://63.102.226.24...va/cfs40300.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zon...oF.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab


SPYSWEEPER RESULTS


********
12:24 PM: | Start of Session, December 18, 2005 |
12:24 PM: Spy Sweeper started
12:24 PM: Sweep initiated using definitions version 586
12:25 PM: Starting Memory Sweep
12:29 PM: Memory Sweep Complete, Elapsed Time: 00:04:54
12:29 PM: Starting Registry Sweep
12:30 PM: Found Adware: adlogix
12:30 PM: HKCR\interface\{2bdb4da9-94fe-4034-aac5-ceecdcb3a33b}\ (8 subtraces) (ID = 102893)
12:30 PM: HKCR\interface\{4d8e41a8-ec1f-4c53-a10d-9120232c71bb}\ (8 subtraces) (ID = 102894)
12:30 PM: HKLM\software\classes\interface\{2bdb4da9-94fe-4034-aac5-ceecdcb3a33b}\ (8 subtraces) (ID = 103008)
12:30 PM: HKLM\software\classes\interface\{4d8e41a8-ec1f-4c53-a10d-9120232c71bb}\ (8 subtraces) (ID = 103009)
12:30 PM: Found Adware: adultlinks
12:30 PM: HKCR\adultbar.adultbar.1\ (3 subtraces) (ID = 103255)
12:30 PM: HKCR\adultbar.adultbar\ (5 subtraces) (ID = 103256)
12:30 PM: HKCR\adultsearch.adultsearch.1\ (3 subtraces) (ID = 103257)
12:30 PM: HKCR\adultsearch.adultsearch\ (5 subtraces) (ID = 103258)
12:30 PM: HKLM\software\classes\adultbar.adultbar.1\ (3 subtraces) (ID = 103279)
12:30 PM: HKLM\software\classes\adultbar.adultbar\ (5 subtraces) (ID = 103280)
12:30 PM: HKLM\software\classes\adultsearch.adultsearch.1\ (3 subtraces) (ID = 103281)
12:30 PM: HKLM\software\classes\adultsearch.adultsearch\ (5 subtraces) (ID = 103282)
12:30 PM: Found Adware: altnet
12:30 PM: HKLM\altnet\ (1 subtraces) (ID = 103447)
12:30 PM: Found Adware: blazefind
12:30 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/bridge.dll\ (2 subtraces) (ID = 104526)
12:30 PM: Found Adware: coolwebsearch (cws)
12:30 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/rundlg32.dll\ (2 subtraces) (ID = 112385)
12:32 PM: Found Adware: squire webhelper
12:32 PM: HKCR\typelib\{4d0ac936-bde8-4ea2-b4fb-9f89e5b4c186}\ (9 subtraces) (ID = 142154)
12:32 PM: HKLM\software\classes\typelib\{4d0ac936-bde8-4ea2-b4fb-9f89e5b4c186}\ (9 subtraces) (ID = 142175)
12:32 PM: Found Adware: websearch toolbar
12:32 PM: HKLM\software\microsoft\windows\currentversion\installer\userdata\aui\ (1 subtraces) (ID = 146479)
12:32 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/qdow.dll\ (2 subtraces) (ID = 146481)
12:33 PM: Found Adware: virtumonde
12:33 PM: HKCR\atldistrib.atldistrib\ (5 subtraces) (ID = 1030533)
12:33 PM: HKCR\atldistrib.atldistrib\clsid\ (1 subtraces) (ID = 1030535)
12:33 PM: HKCR\atldistrib.atldistrib\curver\ (1 subtraces) (ID = 1030537)
12:33 PM: HKCR\atldistrib.atldistrib.1\ (3 subtraces) (ID = 1030539)
12:33 PM: HKCR\atldistrib.atldistrib.1\clsid\ (1 subtraces) (ID = 1030541)
12:33 PM: HKLM\software\classes\atldistrib.atldistrib\ (5 subtraces) (ID = 1030666)
12:33 PM: HKLM\software\classes\atldistrib.atldistrib\clsid\ (1 subtraces) (ID = 1030668)
12:33 PM: HKLM\software\classes\atldistrib.atldistrib\curver\ (1 subtraces) (ID = 1030670)
12:33 PM: HKLM\software\classes\atldistrib.atldistrib.1\ (3 subtraces) (ID = 1030672)
12:33 PM: HKLM\software\classes\atldistrib.atldistrib.1\clsid\ (1 subtraces) (ID = 1030674)
12:33 PM: Found System Monitor: klogger
12:33 PM: HKU\.DEFAULT\software\kaksoftstudio\ (6 subtraces) (ID = 129686)
12:33 PM: Registry Sweep Complete, Elapsed Time:00:03:43
12:33 PM: Starting Cookie Sweep
12:33 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
12:33 PM: Starting File Sweep
12:34 PM: Warning: Failed to open file "c:\windows\win386.swp". The process cannot access the file because it is being used by another process
12:39 PM: Warning: Failed to open file "c:\windows\system\c36bhs.dll". Access is denied
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd1e1d2c5-b071-42cd-9eb1-cdf6263f2bfb.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdbd518b9-6719-4c35-aae0-2459375c5066.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs799bf033-fc61-443c-8f5f-49dbe844d99e.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9937c982-f6fe-44b3-a78c-3bf58ad56ebe.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7c15b438-6af0-4363-8edf-7f3d77a80a0b.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs180fa5bb-db91-4295-bb8a-c7c547858fac.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0a56e5fe-d28f-491b-b967-6ab6bd945154.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs81e228cf-50a1-43c4-971c-d0f3c616b9c1.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5c198ad4-2dab-4a83-9a00-20756b8c8946.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf631bf79-1840-4fb2-a083-05883ef09d6d.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa72e97c3-a215-4273-a9f2-7b02e3ed85dc.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3e8df896-c018-42a0-b570-79fe2db4f015.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsacb2883f-ffae-443d-b920-37ce269bd8e3.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs595cf112-0378-4353-a3df-6d90321688cf.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs992d9eb5-ec4e-4faf-9d24-8824db3217ce.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf4635173-0017-4a7b-850a-c3740cb2a353.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4c53981f-5cc1-4d5d-bba0-431e41d52a23.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs203c02e6-0aa6-4e9f-847a-e405b78064c9.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0d65a42c-50b4-495d-8d88-9f92aa1da326.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc905e850-706e-49dc-9895-e50001de99d0.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsae1d0d1d-b583-4898-a1c2-175c8107d863.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdf2a8bcb-4635-46a3-858d-0a4fcd3c8a7b.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa81bce2a-d4ca-469a-ab99-1446a5282268.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8efaee25-8141-46eb-9bf4-daa301c72605.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc44eae1b-f6d1-43a7-be06-3a66410fd924.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs46c17100-61f9-4c0a-b3b2-655fa3e8c0ec.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3ad2460d-2cab-4ab0-a157-e58d8c3f9f9e.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9ffdfbf4-86ee-44b1-8eb9-c8ba6732335c.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsabd60167-988f-4c27-a511-fbae710f661c.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs89f9e479-b9a1-4b10-afcf-65be2ddf821d.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4ec80553-211a-4371-ae42-f932141f0f28.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsbfbd2a44-2595-40ea-8c52-aa7f0139f50e.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdbdc1c2a-8d9f-4d88-afaa-fc7fa6742ef4.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4d8c37e2-3d96-422b-9ff6-24f757f3cdc0.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa7ed57e3-4338-4bfa-8041-d124016b807f.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsebc6a49a-0ed6-468e-86fe-39684740dbb0.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd81f3d9c-e1b2-491f-9ee5-c37af3faa192.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs27f14a39-3557-4c46-bc06-b6185f37353b.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc169774d-6536-467f-b302-0be0952f40e0.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7832a5a9-8602-48b8-98e6-94023d0b418b.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2c118979-4693-4014-994e-614a21b815c8.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs59797610-431a-4853-82fa-9eade688739e.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsec0976b0-b245-4807-a2ce-8252b3657257.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4b008013-2065-45b6-b059-f67bd6980343.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse403ab8a-c886-4074-a121-cd736406ac7f.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa90548a9-73e8-4e7a-a392-d614c210a92f.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfc7a4857-8e63-4011-9e9c-94eb12ddea80.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1a482cb8-c681-44c1-a90b-3114b004aae5.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0c23fad0-7353-49d9-964f-21bf850fad75.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7b858507-9b8f-4f63-b408-2771ee8c161e.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse3949ea2-46ac-46c2-ba9b-b09969559373.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3ecf9358-fdbd-4553-9c72-732deeba7e13.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs40e3fd0d-008e-48a7-a59b-ba1c93bfe094.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa37532e5-fd3c-4e6f-bce0-234fba8e433f.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsed7629b8-7fe1-437a-b544-f8cd251e25c9.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsafae7f10-0487-462e-b6ec-5fc0fa4a8e56.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs69e7e5be-353f-41e8-9ee5-69b09f3b83c2.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc7aeeb52-87f7-4fec-a2c0-fb40fe4d73c8.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2eb3a422-56c7-435d-8d66-37f2c89845fa.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs825899dd-042e-4032-975f-288ef75c454c.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2efe40e8-417f-4da3-af97-d137b885b613.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9a5d2678-099a-4991-932c-b03c03b94893.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdffa07cb-cbd3-4e79-b981-ffe966dbd70f.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9e5ca798-7ed5-47dd-aa64-31f63c59f08f.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9893cfa9-906d-4005-bb38-b88ae5298a04.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsbe609bb7-7348-4096-aac6-6895a1d5c456.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs38aacd77-bb8d-4b0e-92d4-45495396ff36.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs235f461e-5fb2-4290-8591-c21a12a80b32.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa504e6f4-f1bd-49b6-993a-097a7ddef705.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfaeba4a0-084f-48a6-bbdd-471e0c35824e.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9276e420-73f8-417b-8d23-a5ccb3f1ba72.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8ddbbe3a-6615-4c5c-9b3e-32e409870353.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8299e56d-d686-429b-be99-c01b35cfd694.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs40f33fce-e94e-443a-bcd6-6c41fdd413ac.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1dec31ec-370f-4991-9b29-7e601c660b55.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs99ad78fd-9d52-44b0-ba59-64e54e6909c1.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0799a3e1-785d-4909-9c3a-fcf18a2617ab.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfb164c0c-1717-47b8-bd41-fc661a914337.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf776d39f-8af2-42b3-a783-113d9448ca10.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs715b4184-0d67-4e4c-8335-b9f2e9479c7b.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf31d0479-471a-4cad-b550-0050735f0502.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs789e0b16-b1f0-41e4-8d05-7d2080ef650d.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4a199256-ecd0-48f8-82f9-ad3f1ccf4fe0.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9258ee2a-6027-4b64-be07-a700909bc439.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs882bdb1b-30bd-47ea-b3a0-b57204aed124.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsffcecd87-a750-4228-bc81-cdf9111b1405.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd6e99346-dfd4-4adc-8f11-bd19aa4da446.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs44642e53-040c-46d8-81c1-e79e1ca57b72.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs07b4d9d8-e638-476f-8deb-69c2aef124d7.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa94cbe06-c4c4-4421-921c-c1fa34857935.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse5bc13d5-f52b-4f0a-98fe-813eecba696e.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse6bec012-fbcb-4fbf-9fdc-c2a6e2286ffc.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsee23e04f-9057-4bd7-8321-fd7162c2dbfa.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs27745326-ffa1-437f-bcf6-08a1a820cd29.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc31f8b59-8325-48b3-959b-8e0bca845bea.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6c3fc21c-fa06-4044-9d4e-066e69c68d1f.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa0bd1028-23b4-4df1-b4ff-e7826efde28e.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9ea8ca65-3e05-4fb4-ae54-79ff57d82015.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs97f21f08-1038-4ca7-bc23-852781f5bb36.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3c73b8de-9d63-4f5c-aa0d-3a406c09e414.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0dc02fb6-fe0e-433a-87e0-de1d1d9f6f11.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd00e2b4b-80dc-49c8-baf4-fd275a5a141d.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3da7783e-1e78-44bd-a832-ceb9814b5717.tmp". The process cannot access the file because it is being used by another process
12:44 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf9d3dec3-2f71-49ee-b304-3d20c3cb9002.tmp". The process cannot access the file because it is being used by another process
12:50 PM: Found Adware: winantispyware 2005
12:50 PM: c:\program files\common files\winsoftware (ID = -2147476682)
1:06 PM: File Sweep Complete, Elapsed Time: 00:32:44
1:06 PM: Full Sweep has completed. Elapsed time 00:41:27
1:06 PM: Traces Found: 149
1:26 PM: Removal process initiated
1:26 PM: Quarantining All Traces: adlogix
1:26 PM: Quarantining All Traces: klogger
1:26 PM: Quarantining All Traces: virtumonde
1:26 PM: Quarantining All Traces: websearch toolbar
1:26 PM: Quarantining All Traces: adultlinks
1:26 PM: Warning: Failed to export "HKEY_LOCAL_MACHINE\software\classes\adultsearch.adultsearch.1\": An I/O operation initiated by the registry failed unrecoverably. The registry could not read in, or write out, or flush, one of the files that contain the system's image of the registry
1:26 PM: Failed to quarantine adultlinks
1:26 PM: Failed to quarantine HKLM: software\classes\adultsearch.adultsearch.1\
1:26 PM: Quarantining All Traces: blazefind
1:26 PM: Quarantining All Traces: coolwebsearch (cws)
1:26 PM: Quarantining All Traces: squire webhelper
1:26 PM: Quarantining All Traces: altnet
1:26 PM: Quarantining All Traces: winantispyware 2005
1:26 PM: Removal process completed. Elapsed time 00:00:25

#9 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 18 December 2005 - 02:00 PM

We're getting there :thumbup: I want you to unplug your cable / phone line from the internet. Next: Restart your computer in Safe Mode. Press the F8 key until the startup menu appears. Choose the Safe Mode option then press Enter. This can take a few minutes to load: Once in Safe Mode: Open Spysweeper, Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box. Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection! When the sweep has finished, click Remove. Click Select All and then Next From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient. Exit Spy Sweeper. Empty Recycle Bin Plug the internet cable / line back in. Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread. Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#10 summer284

summer284

    New Member

  • New Member
  • Pip
  • 7 posts

Posted 18 December 2005 - 03:43 PM

Hi

Here is my HJT log and spysweeper results.

There was nothing to remove in spysweeper in safe mode. When I rebooted my computer
was running good.

Thanking you,



Logfile of HijackThis v1.99.1
Scan saved at 3:33:16 PM, on 18/12/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nba.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - C:\PROGRA~1\ZEROPO~1\ZERO-P~1.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Shaw Help - {C74D011F-7BCC-441A-B871-AC7817CB9B90} - http://support.shaw.ca (file missing) (HKCU)
O9 - Extra button: GooGle - {D7AEB2C9-9F00-4CD5-A173-AF67AA4F4877} - http://www.google.ca (file missing) (HKCU)
O9 - Extra button: WebMail - {8DFCB8CA-10AD-4955-888F-A23211529E32} - https://webmail.shaw.ca (file missing) (HKCU)
O9 - Extra button: eBay - {31F89B98-4F65-4866-8F3E-53DFD669AA46} - http://www.ebay.com (file missing) (HKCU)
O9 - Extra button: SOD - {72583D76-270D-41B1-BA4A-1619E8DF2E58} - http://www.shawondemand.ca (file missing) (HKCU)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c...ials/ymmapi.dll
O16 - DPF: Yahoo! Cribbage - http://download.game...nts/y/it0_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/p...t/msnchat45.cab
O16 - DPF: Yahoo! Go - http://download.game...nts/y/gt1_x.cab
O16 - DPF: Tornado 21 - http://download.game...s/y/t21t0_x.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.s...og/y/fs10_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct2_x.cab
O16 - DPF: Video Poker - http://download.game...ts/y/vpt0_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.game...ts/y/ywt0_x.cab
O16 - DPF: Yahoo! Exploder - http://download.game...nts/y/vtk_x.cab
O16 - DPF: ChatSpace Full Java Client 4.0.0.300 - http://63.102.226.24...va/cfs40300.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zon...oF.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab



SPY SWEEPER RESULTS

********
2:49 PM: | Start of Session, December 18, 2005 |
2:49 PM: Spy Sweeper started
2:49 PM: Sweep initiated using definitions version 586
2:49 PM: Starting Memory Sweep
2:51 PM: Memory Sweep Complete, Elapsed Time: 00:02:00
2:51 PM: Starting Registry Sweep
2:54 PM: Registry Sweep Complete, Elapsed Time:00:02:43
2:54 PM: Starting Cookie Sweep
2:54 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
2:54 PM: Starting File Sweep
2:54 PM: Warning: Failed to open file "c:\windows\win386.swp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs51464608-026b-452a-8bb3-3d00448a756d.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0ca5068d-748c-4ba4-bf5d-de15aad81cb5.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7153e21a-214b-4426-beba-ff95815ec66e.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs652b7864-5535-4a6e-b728-7512db2f6ea3.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3b6de423-1e2c-4ef6-ad2f-9dc4f3d576d4.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6005b737-b9d5-4708-9805-5801b2f81e78.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa15a0b8d-2fa5-4604-ae0f-9e45e0794fd1.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse03e018d-c692-47b5-8bfb-ab53d2c84549.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsba11beff-589a-401c-9200-85ba73d06d83.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc66a1112-5644-4aef-a818-17f42a2416a3.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscacfae0c-2c6b-41f3-b693-38cb9475c4cd.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs81c2126f-1392-45ee-b517-8ff57b77792e.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs972c2a55-3204-4f45-acad-0aeda5ddc96d.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs999f5a69-9956-4c7b-9ba7-8422cd9ed15a.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs150e8629-73ea-4446-a2e1-32bcda31e8dc.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscseb065d89-ce0d-4a8f-8ca3-8d4aeb0ceb85.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs09452fda-2209-4e37-8d73-2bc099019e0f.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd1db2364-b3b3-4131-90ee-4880df990b16.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd424fb8e-9326-4a7a-9a3e-d49a19c46e8b.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsabe3adc2-f3e6-4e89-a53d-0e166c693da8.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb995701f-d9aa-44f0-8567-840308cf13a9.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4834e010-8e9e-4831-a13c-2db4f6caf885.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse9e38ae2-02df-4d7b-9303-c5b15af6950c.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1ff8697a-5b2f-4a60-b310-52dd1f8aa2d8.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs356fe505-3532-4c58-b9c3-569da6ec3f31.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd6725c2a-bc0c-43b3-b9f3-57dfd7faeb37.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9568f722-54d9-4fab-9834-c9ee8d125306.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5a542f6c-3ed3-4a7a-8aa5-48814de7297e.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb628369e-a0c1-4d8c-8a75-4ffa1131867e.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs13c11357-d4f3-4035-addd-8fbb4b0cd4bb.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa2e5d1b3-fc9b-477e-af36-ebed8234f0c7.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs42b6336d-5243-48e1-bba3-1452cfcd4597.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsda905ef3-6f10-444e-95ab-4416550131eb.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs91b708a1-a488-438c-aafe-dc5fb75cbddb.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse5e96376-710d-4810-aae9-6814d21a734d.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa80bec8b-c665-4ae9-9efd-03b3e01c4399.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1d8c2a13-3550-4006-a52f-5b71c11b2efb.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse9397d6c-16b7-4676-8887-6841d65e8c4a.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2cd20ee6-b886-4623-890d-872d88f035be.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs72a9330b-8a5f-46c5-84c3-ff086fb4cc36.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6f5036c2-4a43-4f06-95d9-1dc943440971.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4866ba91-0cf9-4b9a-9875-ecfa6547e4a9.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf7ab097e-a0a8-45c3-ac8a-bb1757006f7a.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs63ca558e-d1ae-47b7-a97d-c2864257603a.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsddeb7179-111d-46ea-9c07-b4571e95f395.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs263e9d7f-97dc-4307-bede-14eab6d28eb2.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9c259f3a-61a6-46ee-9172-81895d052232.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7de80a3c-4f3e-4bfe-bbb8-8a58b9dee3f4.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse85daed3-43b6-4baa-930f-a3c563e20579.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3bf06aa3-d2fd-478c-a419-f71f76b857b4.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2f304c1e-3940-452e-aa72-e72b69557bd4.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscd0a0bee-26f8-4633-8faa-23556c081e50.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs76db5829-0000-4d85-bb73-c9a8c53d6e80.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd8a217f8-d77c-4402-aa6c-48a96a9bb0df.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscbeda02f-a048-454c-9ff3-bbd93e5e5ab3.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdcfb6f1d-bb3e-47de-92c2-7c3b3f454b66.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs65e1ed2e-a4e4-4f2b-a99e-4ec6978bd220.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7460aa4d-f65d-4757-9d82-33a62ab2c93c.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4c6279b5-64be-411c-b415-5cceb2c2bd55.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb1a83d85-a713-445b-846c-939c5d2c471a.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2b07a625-62bf-4860-a57d-287cd100c461.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4bdc3881-4216-4403-84ec-08b8eba757e6.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsea27669c-e21d-49a6-a7fe-c5a4a5c22627.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsacf43ec8-a8a1-4f64-87f5-5c204a9bedc1.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsba7de2c3-d493-41c7-a4ca-e7bcc2ffc9a8.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs47939444-9f07-49bf-a840-daaf63b6636e.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0943c67d-39ae-4698-8152-850345e137c1.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc1be6358-dea9-4b45-b5c8-70381ebc2051.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8a354bdb-8d20-4cd6-acb8-adb00e22697b.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs84c25474-8a73-4cea-8f9b-0a79fdc21655.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs96d19090-2d63-4230-ab6b-9770ac925ed1.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2ffd1bae-a291-4844-b549-3f4a1dcd8f08.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs12578a88-c9d8-4f89-be62-18b9865ad017.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa6d8d98e-e1d7-416f-9bba-30be6fc97c60.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsde8a466d-9b82-4f65-8f04-04d9a90b8eef.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc8c44f89-3abb-42f4-ac12-a777d3597a79.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdedb30fd-f3d5-4e72-9b95-dfd450ee7eb0.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf37e231c-665a-406c-9a2c-11daec1fcae5.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsba0a480a-0eb8-4b75-84ce-e0e2e1f071dc.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd599c2b3-574d-45f0-a9fa-4ea6f36ef59a.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs669013cc-c308-4326-956a-51917a89fa3c.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7df67c20-6a83-4c0f-9f1c-55a6714c4d68.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd55553a7-ee67-4194-b62f-0f4f26292cac.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs63b6c9fb-33f7-42b8-91c1-b37e21c80b30.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsbf098a73-1fb3-456c-8d3a-9c370130aa21.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5cfcf628-e6d6-49f9-8e25-3c040443942b.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc148d10c-7bb7-47ae-a6cd-8b761ddecfc0.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc32839ce-6fe7-40a7-91c2-a20618421675.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs623b14ac-904a-4cb6-a3bc-e7c39f7df6e9.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb602ff6c-f14d-4bb3-95c9-80ab7e5cdef6.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsae004b58-9b9d-43fc-918a-9205a506398a.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3faab124-3d55-4615-ae80-95283f1052a9.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs87983995-7e5c-4e2e-b981-333c9ee8f3c4.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs88fb9e8b-a696-4d70-ad64-0d34ce76051d.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3ff7564a-476f-4c51-894c-381f154998b6.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs36b3c3d4-fbe4-47e4-906c-339a493403f7.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs47918722-6a55-4044-af81-8dc9ac53ab8c.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdfd6b64a-f6ac-4211-9f7b-c703dec38792.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs679d3dbc-b71f-4b4b-aef6-c9de3959f57d.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa2200da5-59ec-4739-962f-066c9dcb6273.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1bb375f2-903f-4618-b445-8dfe63e19de0.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf08d2514-b962-46ec-82ab-5080185df875.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3ec5174d-2fe3-422c-9fa8-576876e90fa0.tmp". The process cannot access the file because it is being used by another process
3:02 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1dffccf6-13f8-4993-96a3-f928f9d524dc.tmp". The process cannot access the file because it is being used by another process
3:16 PM: File Sweep Complete, Elapsed Time: 00:21:19
3:16 PM: Full Sweep has completed. Elapsed time 00:26:06
3:16 PM: Traces Found: 0
********

#11 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 18 December 2005 - 03:46 PM

Good Job :thumbup:


Log looks good :D :thumbup: How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK




If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#12 summer284

summer284

    New Member

  • New Member
  • Pip
  • 7 posts

Posted 18 December 2005 - 05:47 PM

Thanks so much, my computer is running back to normal again. Your website is totally awesome. Thanks again

#13 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 18 December 2005 - 05:59 PM

Great job :thumbup: You're more then welcome. Glad we were able to help Peace be with you :wavey:

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#14 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 18 December 2005 - 06:10 PM

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users