This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I need help with SURFSIDEKICK & Slow Computer

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I can not get rid of the spyware (or malware) SURFSIDEKICK. I have tried for months and it is not working. After I delete it it just reinstalls. Also My computer is so slow it is hard to load pages. Please help me with this.
Thanks in advance,
Bill


Logfile of HijackThis v1.99.1
Scan saved at 3:37:54 PM, on 12/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
C:\WINDOWS\system32\PGPserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Anti-Spam\QSP-2.1.212.0\QOELoader.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetTray.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~3\ca.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\CML50614.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\PerSono\perstray.exe
C:\Program Files\Microsoft Office\Office10\msoffice.exe
C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program Files\United Devices\UD.EXE
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\United Devices\ud_7174683.exe
C:\Program Files\United Devices\ud_7174683_0.dir\ud_ligfit_Release.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetMsg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Download\HijackThis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Anti-Spam\QSP-2.1.212.0\QOELoader.exe"
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetTray.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\CA\ETRUST~1\ETRUST~3\ca.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [gklcvlbjko] C:\WINDOWS\\\\\\\\\\\
O4 - HKLM\..\Run: [f99f4ff8b3d2] C:\WINDOWS\system32\CML50614.exe
O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
O4 - HKLM\..\RunOnce: [GIANTAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Startup: Zstart.lnk = C:\Documents and Settings\Bill\Local Settings\Temp\zxinst12.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Perstray.lnk = ?
O4 - Global Startup: PGPtray.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZNfox000
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'xfire_lsp_10226.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-36.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - http://www.disney.go.com/games/downloads/g…GameManager.cab
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
hi sorry for the late reply, as you can see we have more that our fair share of logs… if you still require assistance please post a fresh HJT log here and i'll take a look at it i will get a notification on your reply and i will respond as soon as possible. due to time zone differences you may have to wait some time thank you for your patience
illukka,
Thank you for responding. Here is the new scan:

Logfile of HijackThis v1.99.1
Scan saved at 4:05:09 PM, on 1/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\WINDOWS\system32\PGPserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetMsg.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Anti-Spam\QSP-2.1.212.0\QOELoader.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetTray.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~3\ca.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\CML50614.exe
C:\Program Files\Common Files\AOL\1136410775\ee\AOLSoftware.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\PerSono\perstray.exe
C:\Program Files\Microsoft Office\Office10\msoffice.exe
C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program Files\United Devices\UD.EXE
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\United Devices\ud_7174683.exe
C:\Program Files\United Devices\ud_7174683_0.dir\ud_ligfit_Release.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Download\HijackThis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Anti-Spam\QSP-2.1.212.0\QOELoader.exe"
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetTray.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\CA\ETRUST~1\ETRUST~3\ca.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [gklcvlbjko] C:\WINDOWS\\\\\\\\\\\
O4 - HKLM\..\Run: [f99f4ff8b3d2] C:\WINDOWS\system32\CML50614.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1136410775\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Startup: Zstart.lnk = C:\Documents and Settings\Bill\Local Settings\Temp\zxinst12.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Perstray.lnk = ?
O4 - Global Startup: PGPtray.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZNfox000
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'xfire_lsp_10226.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-36.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - http://www.disney.go.com/games/downloads/g…GameManager.cab
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
hi

thanks for posting your log

looks interesting ;)

lets first try some scans:


Please follow the instructions provided, you may want to print out these instructions and use them as a reference.

Please download ewido security suite it is a trial version of the program.
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck..
    • Install background guard
    • Install scan via context menu
  • Launch ewido, there should be an icon on your desktop, double-click it.
  • The program will now open to the main screen.
  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  • You will need to update ewido to the latest definition files.
    • On the left hand side of the main screen click update.
    • Then click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
    (the status bar at the bottom will display ("Update successful")
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Once the updates are installed do the following:

reboot your computer in SafeMode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.
then launch ewido:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • You will be prompted to clean the first infection.
  • Select "Perform action on all infections", then proceed.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop or a location where you can find it easily.
Close ewido security suite.

reboot back to normal mode, post the ewido report and a log from a fresh hjt scan
illukka - Thanks for your quick response. Here are the results to the scan and the new HJT: ——————————————————— ewido anti-malware - Scan report ——————————————————— + Created on: 7:59:33 PM, 1/7/2006 + Report-Checksum: A6ED3401 + Scan result: HKLM\SOFTWARE\Classes\AtlControl.AtlCtrl -> Spyware.HotBar : Cleaned with backup HKLM\SOFTWARE\Classes\AtlControl.AtlCtrl\CLSID -> Spyware.HotBar : Cleaned with backup HKLM\SOFTWARE\Classes\AtlControl.AtlCtrl\CurVer -> Spyware.HotBar : Cleaned with backup HKLM\SOFTWARE\Classes\AtlControl.AtlCtrl.1 -> Spyware.HotBar : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{C886256C-7A63-4213-AD2F-02AD3735DF06} -> Spyware.HotBar : Cleaned with backup HKLM\SOFTWARE\Classes\Common.Buttons -> Spyware.WebSearch : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{3F947DE3-D937-414D-AF0A-548A4148A5E6} -> Spyware.HotBar : Cleaned with backup HKLM\SOFTWARE\Classes\Interface\{717BEB87-70F4-4EAB-80D4-E357B3619530} -> Spyware.HotBar : Cleaned with backup HKLM\SOFTWARE\Classes\TypeLib\{D6C76AA4-8532-4AFD-841D-287972A9E1E8} -> Spyware.HotBar : Cleaned with backup HKLM\SOFTWARE\Dsi -> Spyware.Delfin : Cleaned with backup HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{120E090D-9136-4b78-8258-F0B44B4BD2AC} -> Spyware.Maxspeed : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{8F9FBEB8-D216-4d6c-8D21-513157E09C0D} -> Spyware.Maxspeed : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{A55581DC-2CDB-4089-8878-71A080B22342} -> Spyware.CoolWebSearch : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DisplayUtility -> Spyware.Delfin : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F9FBEB8-D216-4d6c-8D21-513157E09C0D} -> Spyware.Maxspeed : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} -> Spyware.MyWebSearch : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{120E090D-9136-4B78-8258-F0B44B4BD2AC} -> Spyware.Maxspeed : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12F02779-6D88-4958-8AD3-83C12D86ADC7} -> Spyware.ActiveSearch : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{339BB23F-A864-48C0-A59F-29EA915965EC} -> Spyware.HuntBar : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87766247-311C-43B4-8499-3D5FEC94A183} -> Spyware.HuntBar : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8952A998-1E7E-4716-B23D-3DBE03910972} -> Spyware.HuntBar : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75} -> Spyware.NetNucleus : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{952EC978-4920-4F18-8237-91D69B54C580} -> Spyware.SearchLocate : Cleaned with backup HKU\S-1-5-21-1599702190-3227411526-1824030370-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EAEB34-F7B5-4C55-87FF-720FAF53D841} -> Spyware.MidAddle : Cleaned with backup [204] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup [252] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup [264] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup [412] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup [484] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup [556] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup [764] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup :mozilla.15:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.22:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.23:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.24:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.25:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.26:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.27:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.28:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.31:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.32:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.33:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.34:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.35:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.37:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.38:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.39:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.40:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.41:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.42:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.43:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.44:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.45:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.46:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.47:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.48:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.49:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.50:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.51:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.52:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.53:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.54:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.55:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.56:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.57:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.60:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.61:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.62:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.77:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.78:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.79:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.90:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.91:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.92:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.93:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.94:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.95:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.96:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.97:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.115:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup :mozilla.133:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.140:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.141:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.152:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.153:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.154:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.155:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.173:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.185:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.186:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.202:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.203:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.219:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.220:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.221:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.222:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.223:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.224:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.225:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.226:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.227:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.228:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.229:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.230:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.231:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.232:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.233:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.234:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.253:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.257:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Hypertracker : Cleaned with backup :mozilla.287:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.307:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.308:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.319:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.333:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.336:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup :mozilla.350:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.351:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.352:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.365:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.366:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.367:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.401:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.402:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.403:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.412:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.413:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.440:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup :mozilla.441:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup :mozilla.493:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup :mozilla.514:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.515:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.516:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.517:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.518:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.519:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.520:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup C:\Documents and Settings\Bill\Cookies\[removed][1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Bill\Cookies\[removed][2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup C:\Documents and Settings\Bill\Cookies\[removed][2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup C:\Documents and Settings\Bill\Cookies\[removed][1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup C:\Documents and Settings\Bill\Cookies\bill@yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.6:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.7:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.8:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.9:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.10:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.11:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.12:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.13:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.14:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.15:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.16:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.17:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.18:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.22:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.23:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.24:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.25:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Adbrite : Cleaned with backup :mozilla.32:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.33:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.34:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.35:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.42:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.43:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.44:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.45:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.46:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.58:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.59:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.60:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.61:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.62:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.89:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.96:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.97:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.98:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.99:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.100:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.101:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.104:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.105:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.110:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.111:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.134:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.138:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.139:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.140:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.141:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.142:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.185:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Hypertracker : Cleaned with backup :mozilla.231:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.265:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.268:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Pro-market : Cleaned with backup :mozilla.269:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Pro-market : Cleaned with backup :mozilla.271:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.289:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup :mozilla.295:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.296:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.297:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.298:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.299:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.306:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.307:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.308:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.309:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.310:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.311:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.312:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.313:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.326:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.327:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.328:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.329:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.330:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.331:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.332:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.333:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.334:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.335:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.336:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.337:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.338:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.367:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.368:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.369:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.370:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.372:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.373:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.374:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.375:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.376:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.387:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.388:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.389:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.406:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup :mozilla.407:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup :mozilla.408:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup :mozilla.420:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Masterstats : Cleaned with backup :mozilla.469:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup :mozilla.483:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.484:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.485:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\cd0gh0dr.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup :mozilla.6:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.7:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.8:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.9:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.10:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.11:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.12:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.13:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.14:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.15:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.16:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.17:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.18:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.19:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.34:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Adbrite : Cleaned with backup :mozilla.35:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Adbrite : Cleaned with backup :mozilla.41:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup :mozilla.42:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup :mozilla.43:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup :mozilla.44:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.45:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.46:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.49:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.50:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.51:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.52:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.53:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.54:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.75:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.76:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.77:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.78:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.80:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.81:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.82:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.83:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.84:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.94:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.97:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.98:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.99:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.100:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.101:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.102:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.105:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.122:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.123:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.124:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.125:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.126:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.127:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.128:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.129:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.130:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.254:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.255:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.259:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.266:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.281:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup :mozilla.284:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.285:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.286:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.287:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.288:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.297:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.298:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Sta
hi

looks like the ewido report was too long to fit in a forum post. wel no problem, the next ewido log will be shorter ;)


first open control panel> add remove programs applet and uinstall surf side kick if its there
reboot

next:
Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.
  • Save it to your desktop.
  • Please double-click Killbox.exe to run it.
  • Select:
    • Replace on Reboot
    • Use dummy
    • then Click on the All Files button.
  • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\WINDOWS\system32\repairs.dll


  • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  • Click the red-and-white Delete File button. Click Yes at the replace on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.


once the machine is back up after killbox:

open ewido, uodatre the definitions, then close ewido, dont scan yet

next:
open hijackthis

click do a system scan only

put checkmarks next to the following items ( if still there ):
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [gklcvlbjko] C:\WINDOWS\\\\\\\\\\\
O4 - HKLM\..\Run: [f99f4ff8b3d2] C:\WINDOWS\system32\CML50614.exe
O4 - HKCU\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - Startup: Zstart.lnk = C:\Documents and Settings\Bill\Local Settings\Temp\zxinst12.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZNfox000
O20 - AppInit_DLLs: repairs.dll



then close all browser and explorer windows
and click the fix checked-button

reboot into safe mode

once there lauch ewido, do a full scan, cleaning all infections
save the report when ready

reboot back to normal mode, post the ewido report and a log from a fresh hjt scan
illukka - Thanks again - Here are the reports. There was one anomaly which I will post first:

An unexpected error has occurred at procedure: modBackup_MakeBackup(sItem=O20 - AppInit_DLLs: repairs.dll)
Error #5 - Invalid procedure call or argument

Please email me at [removed], reporting the following:
* What you were trying to fix when the error occurred, if applicable
* How you can reproduce the error
* A complete HijackThis scan log, if possible

Windows version: Windows NT 5.01.2600
MSIE version: 6.0.2900.2180
HijackThis version: 1.99.1

This message has been copied to your clipboard.
Click OK to continue the rest of the scan.



Logfile of HijackThis v1.99.1
Scan saved at 11:03:15 PM, on 1/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\PGPserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetMsg.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Anti-Spam\QSP-2.1.212.0\QOELoader.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetTray.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~3\ca.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1136410775\ee\AOLSoftware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\PerSono\perstray.exe
C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program Files\United Devices\UD.EXE
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Microsoft Office\Office10\msoffice.exe
C:\Program Files\United Devices\ud_7174683.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\United Devices\ud_7174683_0.dir\ud_ligfit_Release.exe
C:\Download\HijackThis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Anti-Spam\QSP-2.1.212.0\QOELoader.exe"
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetTray.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\CA\ETRUST~1\ETRUST~3\ca.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1136410775\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Perstray.lnk = ?
O4 - Global Startup: PGPtray.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'xfire_lsp_10226.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-36.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - http://www.disney.go.com/games/downloads/g…GameManager.cab
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

———————————————————
ewido anti-malware - Scan report
———————————————————

+ Created on: 10:50:22 PM, 1/8/2006
+ Report-Checksum: 84403AF8

+ Scan result:

[204] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup
[252] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup
[264] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup
[420] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup
[488] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup
[552] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup
[764] C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\d9izre30.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Bill\Desktop\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Billy\Application Data\Mozilla\Firefox\Profiles\hikbsnta.Default User\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\WINDOWS\system32\repairs.dll -> Spyware.Hijacker.Generic : Cleaned with backup


::Report End
hmm that is odd, i must ask merijn about this

but meanwhile:

could you upload the file C:\WINDOWS\system32\repairs.dll to http://www.thespykiller.co.uk/forum/index.php?board=1.0

first read http://www.thespykiller.co.uk/forum/index.php?topic=5.0
the press new topic and attach the file to your message
include a link to here into your message thank you

also i noticed in your log that you have a seriously out of date version of suns java

uninstall the earlier versions from add remove programs, then download/install the newest from
http://www.java.com/en/download/manual.jsp

the older versions have dangerous security holes
lets try again with killbox.

this time, before starting the procedure boot into safe mode:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

once in safe mode:
* Please double-click Killbox.exe to run it.
* Select:
o Replace on Reboot
o Use dummy
o then Click on the All Files button.
* Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\repairs.dll


* Return to Killbox, go to the File menu, and choose Paste from Clipboard.
* Click the red-and-white Delete File button. Click Yes at the replace on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.


once the machine is back up after killbox:

open ewido, uodatre the definitions, then close ewido, dont scan yet

next:
open hijackthis

click do a system scan only

put checkmarks next to the following items ( if still there ):
O20 - AppInit_DLLs: repairs.dll




then close all browser and explorer windows
and click the fix checked-button

reboot into safe mode

once there lauch ewido, do a full scan, cleaning all infections
save the report when ready

reboot back to normal mode, post the ewido report and a log from a fresh hjt scan
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI