pop up problems

Hi, Everytime IE opens, some popup ads open as well. I ran AdAware and it did find some objects (Adexa etc) and deleted them but the same ones keep coming back the moment I re-open IE and AdAware picks them up again. Apparently these nasties are really hidden some place and reinstall themselves. Symantec antivirus is also installed on this computer. Please help.

Here is HJT log.

Logfile of HijackThis v1.99.1
Scan saved at 2:20:55 PM, on 2/3/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Apps\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Apps\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\NavNT\DefWatch.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
C:\WINNT\System32\cidaemon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\AGRSMMSG.exe
C:\WINNT\system32\PRPCUI.exe
C:\WINNT\system32\Promon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINNT\system32\RunDll32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMAPP.EXE
C:\PROGRA~1\NavNT\vptray.exe
C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\NtsAgent.exe
C:\Program Files\Support.com\bin\sdcappmeter.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Apps\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jucheck.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\system32\hpsw.exe
C:\Program Files\lavasoft\Ad-Aware SE Professional\Ad-Aware.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wgse.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Apps\Yahoo\Messenger\ymsgr_tray.exe
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\eaai\riaa.exe
C:\WINNT\system32\r?ndll32.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Apps\Tools\3M\PSNLite\PsnLite.exe
C:\Program Files\Interwise\Student\pull.exe
C:\Palm\HOTSYNC.EXE
C:\Apps\Tools\3M\PSNLite\PSNGive.exe
C:\Apps\Tools\HijackThis\HijackThis.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\naldaemn.EXE
C:\Program Files\Notes\nwrdaemn.EXE
C:\Program Files\Notes\nupdate.EXE
C:\Program Files\Notes\namgr.EXE
C:\Program Files\Notes\nhldaemn.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cloroxweb.clorox.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cloroxweb.clorox.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://cloroxweb.clorox.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by The Clorox Company
R3 - URLSearchHook: (no name) - {00E10294-9721-9CFC-2C00-BCCE6FCBEF92} - C:\WINNT\system32\wgeve.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00E10294-9721-9CFC-2C00-BCCE6FCBEF92} - C:\WINNT\system32\wgeve.dll
O2 - BHO: bitlocker - {01EB5130-FC0C-4d75-B9CE-4801B1B854F5} - C:\WINNT\system32\nsy26.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Apps\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Trecker Class - {39C78B50-7E98-4aa0-B007-D83114EA6E0F} - C:\PROGRA~1\Jalmp\jalmp.dll
O2 - BHO: FlpLauncher Class - {4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} - C:\Program Files\E-Book Systems\FlipViewer\fplaunch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [iamapp] C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMAPP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [EasySync Pro - LtNts4] C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\NtsAgent.exe
O4 - HKLM\..\Run: [EasySync Pro - 3CmPlm] C:\Program Files\Common Files\XCPCSync\Translators\3CmPlm\AutoDet.exe
O4 - HKLM\..\Run: [EasySync Pro] C:\Program Files\Common Files\XCPCMenu.exe
O4 - HKLM\..\Run: [SDCrun] "C:\Program Files\Support.com\bin\sdcappmeter.exe" /startmeter http://esupport.clorox.com:8080/global/
O4 - HKLM\..\Run: [QuickTime Task] "C:\Apps\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Apps\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [susse] "C:\WINNT\system32\hpsw.exe"
O4 - HKLM\..\Run: [Ad-Aware] "C:\Program Files\lavasoft\Ad-Aware SE Professional\Ad-Aware.exe" +c
O4 - HKLM\..\RunOnce: [Register OCX] regsvr32.exe /s msdxm.ocx
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Apps\Yahoo\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [] Sametime
O4 - HKCU\..\Run: [Sametime] http://cpcst01.clorox.com/sametime.html
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [Tash] "C:\Program Files\eaai\riaa.exe" -vt yazb
O4 - HKCU\..\Run: [Jzazegg] C:\WINNT\system32\r?ndll32.exe
O4 - HKCU\..\Run: [irssyncd] C:\WINNT\system32\irssyncd.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Apps\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Apps\Tools\3M\PSNLite\PsnLite.exe
O4 - Global Startup: Push Client.LNK = C:\Program Files\Interwise\Student\pull.exe
O4 - Global Startup: VPN Dialer (OnStartup).lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Apps\Yahoo\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Apps\Yahoo\Messenger\yhexbmes0411.dll
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: (no name) - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://cloroxweb.clorox.com
O15 - Trusted Zone: *.bases.com (HKLM)
O16 - DPF: Sonexis ConferenceManager - http://conf.subway.com/Downloads/cmW32client.cab
O16 - DPF: {050A0128-BE56-4F4B-9F2A-2F926AB5A2F2} (Pvapplite_ie Control) - http://jbs309.clorox.com/PDMLink/wtcore/js…vapplite_ie.cab
O16 - DPF: {495DEA80-49C2-4891-94CD-C2016615D16F} (ProductView Control) - http://jbs309.clorox.com/PDMLink/wtcore/js…d/pvcadview.cab
O16 - DPF: {4C57C98A-E582-46E4-8FD8-5EBDC94CEA39} (Mindjet MindManager Viewer Control) - http://www.mindjet.com/viewer/eng/MjMmViewer.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jbs333/webconnectsql/viewer/ActiveX…tivexviewer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://issspevents.webex.com/client/v_mywe…ent/ieatgpc.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O18 - Filter: text/html - {2F6E85DC-8D2D-4896-8A4F-7DF8A7B1749D} - C:\PROGRA~1\Jalmp\jalmp.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Apps\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: FwSRService - Unknown owner - C:\Program Files\CheckPoint\SecuRemote\bin\fwsrservice.exe
O23 - Service: IBM PM Service (IBMPMSVC) - IBM Corp. - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: Symantec Client Firewall Service (NISSERV) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
O23 - Service: Symantec Client Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Symantec Client Firewall Proxy Service (SymPxSvc) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe

Hello apspbi,
welcome back to the forum

Please read these instructions carefully and print them out! Be sure to follow ALL instructions!

Please print out or copy these instructions\tutorials to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Download SmitRem.exe © noahdfear from one of these sites to your Desktop.
http://www.downloads.subratam.org/smitRem.exe
http://noahdfear.geekstogo.com/click%20cou....php?id=1"

Double-click the smitRem.exe and it will extract the files to a smitRem folder on your Desktop.

Please download the trial version of ewido anti-malware 3.5. Install ewido anti-malware 3.5 and start the program from the icon on your desktop, then check for and download updates. Don't Run Yet.

Reboot to safe mode

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


logon to your user account.
Open the smitfraud folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. When the tool completes:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: (no name) - {00E10294-9721-9CFC-2C00-BCCE6FCBEF92} - C:\WINNT\system32\wgeve.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00E10294-9721-9CFC-2C00-BCCE6FCBEF92} - C:\WINNT\system32\wgeve.dll
O2 - BHO: bitlocker - {01EB5130-FC0C-4d75-B9CE-4801B1B854F5} - C:\WINNT\system32\nsy26.dll
O2 - BHO: Trecker Class - {39C78B50-7E98-4aa0-B007-D83114EA6E0F} - C:\PROGRA~1\Jalmp\jalmp.dll
O4 - HKLM\..\Run: [SDCrun] "C:\Program Files\Support.com\bin\sdcappmeter.exe" /startmeter http://esupport.clorox.com:8080/global/
O4 - HKLM\..\Run: [susse] "C:\WINNT\system32\hpsw.exe"
O4 - HKCU\..\Run: [] Sametime
O4 - HKCU\..\Run: [Sametime] http://cpcst01.clorox.com/sametime.html
O4 - HKCU\..\Run: [Tash] "C:\Program Files\eaai\riaa.exe" -vt yazb
O4 - HKCU\..\Run: [Jzazegg] C:\WINNT\system32\r?ndll32.exe
O4 - HKCU\..\Run: [irssyncd] C:\WINNT\system32\irssyncd.exe
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O15 - Trusted Zone: *.bases.com (HKLM)
O16 - DPF: Sonexis ConferenceManager - http://conf.subway.com/Downloads/cmW32client.cab
O18 - Filter: text/html - {2F6E85DC-8D2D-4896-8A4F-7DF8A7B1749D} - C:\PROGRA~1\Jalmp\jalmp.dll

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete these files in RED if listednot to worry if not there

C:\WINNT\system32\wgeve.dll
C:\WINNT\system32\nsy26.dll
C:\Program files\Jalmp\jalmp.dll
C:\Program Files\Support.com\bin\sdcappmeter.exe"
C:\WINNT\system32\hpsw.exe"
C:\Program Files\eaai\riaa.exe"
C:\WINNT\system32\r?ndll32.exe<–Be very care with this one.
ONLY delete the one with the ? if listed.
C:\WINNT\system32\irssyncd.exe


NEXT:

open search, and seach for file called:
Sametime
Delete if found.

Here is how to seach for a file:

How to Search for a File or Folder
To search for a file or folder:
1. Click Start, and then click Search.
2. In the Search Companion dialog box, click All files and folders.
3. Type part or all of the name of the file or folder, or type a word or phrase that is in the file.
4. In the Look in box, click the drive or drives, folder, or network location that you want to search.
5. Choose one of the following options:
a. Click When was it modified to look for files that were created or modified on or between specific dates.
b. Click What size is it to look for files that are specific size.
c. Click More advanced options to specify additional search criteria.
6. Click Search.



.
Open Ewido Security Suite

* Then please run Ewido, click on the Scanner run a full scan and let
* it clean everything it finds.
* Once the scan has completed, there will be a button located on the bottom
* of the screen named
* Click Save report
* Save the report to your desktop

In the Control Panel click Display > Desktop > Customize desktop > Website > Uncheck "Security Info" if present.

Empty recycle bin.

Reboot

Download this file from the link to your desktop.

http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click on the deldomains.inf file and select 'Install'

Once it is finished your Zones should be reset.

Note, if you use SpywareBlaster and/or IE/Spyads, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE/Spyads, run the batch file and reinstall the protection

"copy/paste" the contents of the log C:\smitfiles.txt a new HijackThis log and the Ewido log.
Also please describe how your computer behaves at the moment.

When I see these new logs there will be some more stuff for you to do.
Good luck m,schroe919

Ok did all that with following exceptions:
Ewido scan - Removed all except I chose not to delete following two entries:
C:\WinNT\Security\Templates\CLXSEC.INF - known company installed security template file.
C:\Program Files\iPass\Sprint Remote Access\idialer.exe - known application used to dial into RAS server for VPN connections.

Right after rebooted, as AdAware automatically runs (setup that way) it still found many critical objects (8) (Adexa etc.) - click on removed.

Opened IE, no popups so far though, seems like it's behaving so far. I'll post if I do see anything unusual.

Please advise next steps…….

Here are the requested logs:
________________________________________________________
Smitfiles.txt:


smitRem © log file
version 2.8

by noahdfear


Microsoft Windows 2000 [Version 5.00.2195]
The current date is: Mon 02/06/2006
The current time is: 17:21:59.14

Running from
C:\Apps\_Installs\Downloads\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 580 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN!
_________________________________________________________________________
HJT Log (Fresh):


Logfile of HijackThis v1.99.1
Scan saved at 7:19:53 PM, on 2/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Apps\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Apps\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\NavNT\DefWatch.exe
C:\Apps\Tools\Security\ewido anti-malware\ewidoctrl.exe
C:\Apps\Tools\Security\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\AGRSMMSG.exe
C:\WINNT\system32\PRPCUI.exe
C:\WINNT\system32\Promon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINNT\system32\RunDll32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMAPP.EXE
C:\PROGRA~1\NavNT\vptray.exe
C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\NtsAgent.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jucheck.exe
C:\Apps\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Adobe\Distillr\Acrotray.exe
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Interwise\Student\pull.exe
C:\Palm\HOTSYNC.EXE
C:\Apps\Yahoo\Messenger\ymsgr_tray.exe
C:\WINNT\System32\cidaemon.exe
C:\Apps\Tools\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cloroxweb.clorox.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cloroxweb.clorox.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://cloroxweb.clorox.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by The Clorox Company
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [iamapp] C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMAPP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [EasySync Pro - LtNts4] C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\NtsAgent.exe
O4 - HKLM\..\Run: [EasySync Pro - 3CmPlm] C:\Program Files\Common Files\XCPCSync\Translators\3CmPlm\AutoDet.exe
O4 - HKLM\..\Run: [EasySync Pro] C:\Program Files\Common Files\XCPCMenu.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Apps\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Apps\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Ad-Aware] "C:\Program Files\lavasoft\Ad-Aware SE Professional\Ad-Aware.exe" +c
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Apps\Yahoo\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = C:\Program Files\Adobe\Acrobat\acrobat_sl.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Apps\Tools\3M\PSNLite\PsnLite.exe
O4 - Global Startup: Push Client.LNK = C:\Program Files\Interwise\Student\pull.exe
O4 - Global Startup: VPN Dialer (OnStartup).lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google; Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate; English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Apps\Yahoo\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Apps\Yahoo\Messenger\yhexbmes0411.dll
O14 - IERESET.INF: START_PAGE_URL=http://cloroxweb.clorox.com
O16 - DPF: {050A0128-BE56-4F4B-9F2A-2F926AB5A2F2} (Pvapplite_ie Control) - http://jbs309.clorox.com/PDMLink/wtcore/js…vapplite_ie.cab
O16 - DPF: {495DEA80-49C2-4891-94CD-C2016615D16F} (ProductView Control) - http://jbs309.clorox.com/PDMLink/wtcore/js…d/pvcadview.cab
O16 - DPF: {4C57C98A-E582-46E4-8FD8-5EBDC94CEA39} (Mindjet MindManager Viewer Control) - http://www.mindjet.com/viewer/eng/MjMmViewer.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jbs333/webconnectsql/viewer/ActiveX…tivexviewer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://issspevents.webex.com/client/v_mywe…ent/ieatgpc.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Apps\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Apps\Tools\Security\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Apps\Tools\Security\ewido anti-malware\ewidoguard.exe
O23 - Service: FwSRService - Unknown owner - C:\Program Files\CheckPoint\SecuRemote\bin\fwsrservice.exe
O23 - Service: IBM PM Service (IBMPMSVC) - IBM Corp. - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: Symantec Client Firewall Service (NISSERV) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
O23 - Service: Symantec Client Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Symantec Client Firewall Proxy Service (SymPxSvc) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe

______________________________________________________________________________________

Ewido Log:
———————————————————
ewido anti-malware - Scan report
———————————————————

+ Created on: 6:40:10 PM, 2/6/2006
+ Report-Checksum: B463028F

+ Scan result:

C:\Program Files\ipass\Sprint Remote Access\idialer.exe -> Heuristic.Win32.Dialer : Ignored
C:\WINNT\security\templates\CLXSEC.INF -> Trojan.Bounce : Ignored
HKLM\SOFTWARE\Classes\CLSID\{4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} -> Spyware.E-booksystems : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} -> Spyware.E-booksystems : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges -> Trojan.Small : Cleaned with backup
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoActiveDesktopChanges -> Trojan.Small : Cleaned with backup
C:\Apps\Tools\HijackThis\backups\backup-20060206-173320-294.dll -> Adware.Suggestor : Cleaned with backup
C:\Documents and Settings\acheema\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\acheema\Cookies\acheema@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\acheema\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\acheema\Cookies\acheema@msnportal.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\acheema\Cookies\acheema@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\acheema\Cookies\acheema@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\All Users\Application Data\Support.com\backup\ID\idialer.exe\811073_59e8f209c_/idialer.exe -> Heuristic.Win32.Dialer : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDD.tmp -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDE.tmp -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDF.tmp -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE0.tmp -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE1.tmp -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE2.tmp -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE4.tmp -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE5.tmp -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\S-1-5-21-643258023-30832913-1542849698-33350\Dc5.exe -> Adware.Suggestor : Cleaned with backup
C:\WINNT\876057.exe -> Adware.Mirar : Cleaned with backup
C:\WINNT\Downloaded Program Files\HDPlugin1019.dll -> Adware.Gator : Cleaned with backup
C:\WINNT\Downloaded Program Files\HDPlugin1101.dll -> Adware.Gator : Cleaned with backup
C:\WINNT\system32\dwdsregtbad.badexe -> Adware.ZenoSearch : Cleaned with backup
C:\WINNT\system32\wgse.exe -> Trojan.Runner.h : Cleaned with backup
C:\WINNT\system32\WinNB57.dll -> Adware.Mirar : Cleaned with backup
C:\WINNT\system32\wuauclt.dll -> Downloader.Small : Cleaned with backup
C:\zac\_AC\Funny\Red\Viagra1.exe -> Not-A-Virus.Joke.Viagra : Cleaned with backup


::Report End
__________________________________________________________________________________

Thanks for your continued help.
The computer is behaving well so far. However, as I mentioned previously, with every reboot, AdAware (Autoruns) finds same 5 critical objects and Quarantines them. The Adaware log is attached for your advise along with the HJT log.
_______________________________________
HJT Log:

Logfile of HijackThis v1.99.1
Scan saved at 4:54:14 PM, on 2/7/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Apps\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Apps\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\NavNT\DefWatch.exe
C:\Apps\Tools\Security\ewido anti-malware\ewidoctrl.exe
C:\Apps\Tools\Security\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\AGRSMMSG.exe
C:\WINNT\system32\PRPCUI.exe
C:\WINNT\system32\Promon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINNT\system32\RunDll32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMAPP.EXE
C:\PROGRA~1\NavNT\vptray.exe
C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\NtsAgent.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jucheck.exe
C:\Apps\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Adobe\Distillr\Acrotray.exe
C:\Apps\Mindjet\MindManager6\MMReminderService.exe
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Apps\Tools\3M\PSNLite\PsnLite.exe
C:\Apps\Yahoo\Messenger\ymsgr_tray.exe
C:\Program Files\Interwise\Student\pull.exe
C:\Apps\Tools\3M\PSNLite\PSNGive.exe
C:\Palm\HOTSYNC.EXE
C:\WINNT\System32\cidaemon.exe
C:\Apps\Tools\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cloroxweb.clorox.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cloroxweb.clorox.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://cloroxweb.clorox.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by The Clorox Company
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Apps\Mindjet\MindManager6\Mm6InternetExplorer.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [iamapp] C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMAPP.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [EasySync Pro - LtNts4] C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\NtsAgent.exe
O4 - HKLM\..\Run: [EasySync Pro - 3CmPlm] C:\Program Files\Common Files\XCPCSync\Translators\3CmPlm\AutoDet.exe
O4 - HKLM\..\Run: [EasySync Pro] C:\Program Files\Common Files\XCPCMenu.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Apps\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Apps\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Ad-Aware] "C:\Program Files\lavasoft\Ad-Aware SE Professional\Ad-Aware.exe" +c
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [MMReminderService] C:\Apps\Mindjet\MindManager6\MMReminderService.exe
O4 - HKLM\..\RunOnce: [Register OCX] regsvr32.exe /s msdxm.ocx
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Apps\Yahoo\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = C:\Program Files\Adobe\Acrobat\acrobat_sl.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Apps\Tools\3M\PSNLite\PsnLite.exe
O4 - Global Startup: Push Client.LNK = C:\Program Files\Interwise\Student\pull.exe
O4 - Global Startup: VPN Dialer (OnStartup).lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Apps\Yahoo\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Apps\Yahoo\Messenger\yhexbmes0411.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Apps\Mindjet\MindManager6\Mm6InternetExplorer.dll
O14 - IERESET.INF: START_PAGE_URL=http://cloroxweb.clorox.com
O15 - Trusted Zone: *.bases.com (HKLM)
O16 - DPF: {050A0128-BE56-4F4B-9F2A-2F926AB5A2F2} (Pvapplite_ie Control) - http://jbs309.clorox.com/PDMLink/wtcore/js…vapplite_ie.cab
O16 - DPF: {495DEA80-49C2-4891-94CD-C2016615D16F} (ProductView Control) - http://jbs309.clorox.com/PDMLink/wtcore/js…d/pvcadview.cab
O16 - DPF: {4C57C98A-E582-46E4-8FD8-5EBDC94CEA39} (Mindjet MindManager Viewer Control) - http://www.mindjet.com/viewer/eng/MjMmViewer.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jbs333/webconnectsql/viewer/ActiveX…tivexviewer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://issspevents.webex.com/client/v_mywe…ent/ieatgpc.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = na.corp.clorox.com,clorox.com,corp.clorox.com
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Apps\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Apps\Tools\Security\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Apps\Tools\Security\ewido anti-malware\ewidoguard.exe
O23 - Service: FwSRService - Unknown owner - C:\Program Files\CheckPoint\SecuRemote\bin\fwsrservice.exe
O23 - Service: IBM PM Service (IBMPMSVC) - IBM Corp. - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec Client Firewall Service (NISSERV) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
O23 - Service: Symantec Client Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Symantec Client Firewall Proxy Service (SymPxSvc) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe
_________________________________________________________________

AdAware Log:


Ad-Aware SE Build 1.05
Logfile Created on:Tuesday, February 07, 2006 4:47:00 PM
Using definitions file:SE1R90 03.02.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Alexa(TAC index:5):3 total references
MRU List(TAC index:0):13 total references
Windows(TAC index:3):2 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Ignore spanned files when scanning cab archives
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Block pop-ups aggressively
Set : Load Ad-Watch minimized
Set : Automatically select problematic objects in results lists
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Show splash screen
Set : Show detail tooltips in results lists
Set : Backup current definitions file before updating
Set : Play sound at scan completion if scan locates critical objects


2/7/2006 4:47:00 PM - Scan started. (Smart mode)

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 212
ThreadCreationTime : 2/8/2006 12:40:35 AM
BasePriority : Normal


#:2 [winlogon.exe]
FilePath : \??\C:\WINNT\system32\
ProcessID : 236
ThreadCreationTime : 2/8/2006 12:40:54 AM
BasePriority : High


#:3 [services.exe]
FilePath : C:\WINNT\system32\
ProcessID : 288
ThreadCreationTime : 2/8/2006 12:40:56 AM
BasePriority : Normal
FileVersion : 5.00.2195.6700
ProductVersion : 5.00.2195.6700
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : services.exe

#:4 [lsass.exe]
FilePath : C:\WINNT\system32\
ProcessID : 300
ThreadCreationTime : 2/8/2006 12:40:56 AM
BasePriority : Normal
FileVersion : 5.00.2195.6902
ProductVersion : 5.00.2195.6902
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Executable and Server DLL (Export Version)
InternalName : lsasrv.dll and lsass.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : lsasrv.dll and lsass.exe

#:5 [ibmpmsvc.exe]
FilePath : C:\WINNT\System32\
ProcessID : 416
ThreadCreationTime : 2/8/2006 12:41:01 AM
BasePriority : Normal
FileVersion : 1, 0, 0, 0
ProductVersion : 1, 0, 0, 0
ProductName : IBM ThinkPad Utility
CompanyName : IBM Corp.
FileDescription : IBM ThinkPad PM Service
InternalName : IBM ThinkPad PM Service
LegalCopyright : Copyright © IBM Corp., 2000.
OriginalFilename : IBMPMSVC.EXE

#:6 [svchost.exe]
FilePath : C:\WINNT\system32\
ProcessID : 476
ThreadCreationTime : 2/8/2006 12:41:03 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINNT\System32\
ProcessID : 520
ThreadCreationTime : 2/8/2006 12:41:03 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:8 [spoolsv.exe]
FilePath : C:\WINNT\system32\
ProcessID : 572
ThreadCreationTime : 2/8/2006 12:41:04 AM
BasePriority : Normal
FileVersion : 5.00.2195.7059
ProductVersion : 5.00.2195.7059
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolss.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : spoolss.exe

#:9 [schedul2.exe]
FilePath : C:\Program Files\Common Files\Acronis\Schedule2\
ProcessID : 640
ThreadCreationTime : 2/8/2006 12:41:11 AM
BasePriority : Normal
FileVersion : 1,0,0,214
ProductVersion : 1,0,0,214
ProductName : Acronis Scheduler 2
CompanyName : Acronis
FileDescription : Acronis Scheduler 2
InternalName : Scheduler2
LegalCopyright : Copyright © 2000-2004 Acronis
LegalTrademarks : Acronis
OriginalFilename : schedul2.exe
Comments : Acronis Scheduler 2

#:10 [ati2evxx.exe]
FilePath : C:\WINNT\System32\
ProcessID : 660
ThreadCreationTime : 2/8/2006 12:41:11 AM
BasePriority : Normal


#:11 [wlservice.exe]
FilePath : C:\Apps\Belkin\Belkin Wireless Network Utility\
ProcessID : 680
ThreadCreationTime : 2/8/2006 12:41:12 AM
BasePriority : Normal


#:12 [wlancfgg.exe]
FilePath : C:\Apps\Belkin\Belkin Wireless Network Utility\
ProcessID : 696
ThreadCreationTime : 2/8/2006 12:41:12 AM
BasePriority : Normal
FileVersion : 1, 0, 3, 5
ProductVersion : 1, 0, 3, 5
ProductName : Wireless Monitor Application
FileDescription : Wireless Monitor Application
InternalName : WLanCfg
LegalCopyright : Copyright © 2002.08
OriginalFilename : WLanCfg.EXE

#:13 [cisvc.exe]
FilePath : C:\WINNT\System32\
ProcessID : 704
ThreadCreationTime : 2/8/2006 12:41:12 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Content Index service
InternalName : cisvc.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : cisvc.exe

#:14 [cvpnd.exe]
FilePath : C:\Program Files\Cisco Systems\VPN Client\
ProcessID : 720
ThreadCreationTime : 2/8/2006 12:41:14 AM
BasePriority : Normal
FileVersion : 3.6.3 (A)
ProductVersion : 3.6.3 (A)
ProductName : Cisco Systems VPN Client
CompanyName : Cisco Systems, Inc.
FileDescription : Cisco Systems VPN Client
InternalName : cvpnd
LegalCopyright : Copyright © 1998-2002 Cisco Systems, Inc.
OriginalFilename : CVPND.EXE

#:15 [defwatch.exe]
FilePath : C:\Program Files\NavNT\
ProcessID : 732
ThreadCreationTime : 2/8/2006 12:41:18 AM
BasePriority : Normal
FileVersion : 8.00.01.425
ProductVersion : 8.00.01.425
ProductName : Norton AntiVirus
CompanyName : Symantec Corporation
FileDescription : Virus Definition Daemon
InternalName : DefWatch
LegalCopyright : Copyright © 1998 Symantec Corporation
OriginalFilename : DefWatch.exe

#:16 [ewidoctrl.exe]
FilePath : C:\Apps\Tools\Security\ewido anti-malware\
ProcessID : 796
ThreadCreationTime : 2/8/2006 12:41:20 AM
BasePriority : Normal
FileVersion : 3, 0, 0, 1
ProductVersion : 3, 0, 0, 1
ProductName : ewido control
CompanyName : ewido networks
FileDescription : ewido control
InternalName : ewido control
LegalCopyright : Copyright © 2004
OriginalFilename : ewidoctrl.exe

#:17 [ewidoguard.exe]
FilePath : C:\Apps\Tools\Security\ewido anti-malware\
ProcessID : 836
ThreadCreationTime : 2/8/2006 12:41:22 AM
BasePriority : Normal
FileVersion : 3, 0, 0, 1
ProductVersion : 3, 0, 0, 1
ProductName : guard
CompanyName : ewido networks
FileDescription : guard
InternalName : guard
LegalCopyright : Copyright © 2004
OriginalFilename : guard.exe

#:18 [hidserv.exe]
FilePath : C:\WINNT\system32\
ProcessID : 896
ThreadCreationTime : 2/8/2006 12:41:26 AM
BasePriority : Normal
FileVersion : 5.00.2195.6655
ProductVersion : 5.00.2195.6655
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : HID Audio Service
InternalName : hidserv
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : HIDSERV.EXE

#:19 [nisum.exe]
FilePath : C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\
ProcessID : 912
ThreadCreationTime : 2/8/2006 12:41:28 AM
BasePriority : Normal
FileVersion : 5.0.1.425
ProductVersion : 5.0
ProductName : Symantec Client Firewall
CompanyName : Symantec Corporation
FileDescription : User Manager
LegalCopyright : Copyright © 2002 Symantec Corporation

#:20 [rtvscan.exe]
FilePath : C:\Program Files\NavNT\
ProcessID : 1008
ThreadCreationTime : 2/8/2006 12:41:32 AM
BasePriority : Normal
FileVersion : 8.00.01.425
ProductVersion : 8.00.01.425
ProductName : Symantec AntiVirus
CompanyName : Symantec Corporation
FileDescription : Symantec AntiVirus
LegalCopyright : Copyright © Symantec Corporation 1991-2002

#:21 [regsvc.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1064
ThreadCreationTime : 2/8/2006 12:41:35 AM
BasePriority : Normal
FileVersion : 5.00.2195.6701
ProductVersion : 5.00.2195.6701
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Remote Registry Service
InternalName : regsvc
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : REGSVC.EXE

#:22 [mstask.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1068
ThreadCreationTime : 2/8/2006 12:41:36 AM
BasePriority : Normal
FileVersion : 4.71.2195.6920
ProductVersion : 4.71.2195.6920
ProductName : Microsoft® Windows® Task Scheduler
CompanyName : Microsoft Corporation
FileDescription : Task Scheduler Engine
InternalName : TaskScheduler
LegalCopyright : Copyright © Microsoft Corp. 1997
OriginalFilename : mstask.exe

#:23 [sympxsvc.exe]
FilePath : C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\
ProcessID : 1104
ThreadCreationTime : 2/8/2006 12:41:39 AM
BasePriority : Normal
FileVersion : 5.0.1.425
ProductVersion : 5.0
ProductName : Symantec Client Firewall
CompanyName : Symantec Corporation
FileDescription : Transparent Proxy Server
LegalCopyright : Copyright © 2002 Symantec Corporation

#:24 [winmgmt.exe]
FilePath : C:\WINNT\System32\WBEM\
ProcessID : 1188
ThreadCreationTime : 2/8/2006 12:41:42 AM
BasePriority : Normal
FileVersion : 1.50.1085.0100
ProductVersion : 1.50.1085.0100
ProductName : Windows Management Instrumentation
CompanyName : Microsoft Corporation
FileDescription : Windows Management Instrumentation
InternalName : WINMGMT
LegalCopyright : Copyright © Microsoft Corp. 1995-1999

#:25 [svchost.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1192
ThreadCreationTime : 2/8/2006 12:41:44 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:26 [nisserv.exe]
FilePath : C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\
ProcessID : 1204
ThreadCreationTime : 2/8/2006 12:41:44 AM
BasePriority : Normal
FileVersion : 5.0.1.425
ProductVersion : 5.0
ProductName : Symantec Client Firewall
CompanyName : Symantec Corporation
FileDescription : IAMSERV.EXE
LegalCopyright : Copyright © 2002 Symantec Corporation

#:27 [explorer.exe]
FilePath : C:\WINNT\
ProcessID : 1464
ThreadCreationTime : 2/8/2006 12:42:15 AM
BasePriority : Normal
FileVersion : 5.00.3700.6690
ProductVersion : 5.00.3700.6690
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : EXPLORER.EXE

#:28 [agrsmmsg.exe]
FilePath : C:\WINNT\
ProcessID : 1664
ThreadCreationTime : 2/8/2006 12:42:43 AM
BasePriority : Normal
FileVersion : 2.1.7 2.1.7 02/22/2002 15:37:42
ProductVersion : 2.1.7 2.1.7 02/22/2002 15:37:42
ProductName : Agere SoftModem Messaging Applet
CompanyName : Agere Systems
FileDescription : SoftModem Messaging Applet
InternalName : smdmstat.exe
LegalCopyright : Copyright © Agere Systems 1998-2000
OriginalFilename : smdmstat.exe

#:29 [prpcui.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1680
ThreadCreationTime : 2/8/2006 12:42:43 AM
BasePriority : Normal
FileVersion : 2.2.0.0
ProductVersion : 2.2.0.0
ProductName : Intel® SpeedStep™ technology applet
CompanyName : Intel Corporation
FileDescription : Intel® SpeedStep™ technology User Interface
InternalName : prpcui.exe
LegalCopyright : Copyright© Intel Corporation 1998-2001
LegalTrademarks : Intel® SpeedStep™ technology
OriginalFilename : prpcui.exe
Comments : Intel SpeedStep technology Applet v2.2

#:30 [promon.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1692
ThreadCreationTime : 2/8/2006 12:42:43 AM
BasePriority : Normal
FileVersion : 5.0.7.0
ProductVersion : 5.0.19.0
ProductName : Intel® PROMonitor
CompanyName : Intel Corporation
FileDescription : Intel® PROSet Tray Icon
InternalName : Intel® PROMonitor
LegalCopyright : Copyright © 1998-2001 Intel Corporation. All Rights Reserved.
OriginalFilename : PROMon.exe
Comments : Configures and tests Intel® PRO family of adapters.

#:31 [syntplpr.exe]
FilePath : C:\Program Files\Synaptics\SynTP\
ProcessID : 1700
ThreadCreationTime : 2/8/2006 12:42:44 AM
BasePriority : Normal
FileVersion : 6.3.8 25Jun02
ProductVersion : 6.3.8 25Jun02
ProductName : Progressive Touch
CompanyName : Synaptics, Inc.
FileDescription : TouchPad Driver Helper Application
InternalName : SynTPLpr
LegalCopyright : Copyright © Synaptics, Inc. 1996-2002
OriginalFilename : SynTPLpr.exe

#:32 [syntpenh.exe]
FilePath : C:\Program Files\Synaptics\SynTP\
ProcessID : 1736
ThreadCreationTime : 2/8/2006 12:42:45 AM
BasePriority : Normal
FileVersion : 6.3.8 25Jun02
ProductVersion : 6.3.8 25Jun02
ProductName : Progressive Touch
CompanyName : Synaptics, Inc.
FileDescription : Synaptics TouchPad Enhancements
InternalName : Scrolleroo
LegalCopyright : Copyright © Synaptics, Inc. 1996-2002
OriginalFilename : SynTPEnh.exe

#:33 [tphkmgr.exe]
FilePath : C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\
ProcessID : 1744
ThreadCreationTime : 2/8/2006 12:42:45 AM
BasePriority : Normal


#:34 [rundll32.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1752
ThreadCreationTime : 2/8/2006 12:42:45 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Run a DLL as an App
InternalName : rundll
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : RUNDLL.EXE

#:35 [iamapp.exe]
FilePath : C:\PROGRA~1\SYMANT~1\SYMANT~1\
ProcessID : 1756
ThreadCreationTime : 2/8/2006 12:42:47 AM
BasePriority : Normal
FileVersion : 5.0.1.425
ProductVersion : 5.0
ProductName : Symantec Client Firewall
CompanyName : Symantec Corporation
FileDescription : IAMAPP.EXE
LegalCopyright : Copyright © 2002 Symantec Corporation

#:36 [vptray.exe]
FilePath : C:\PROGRA~1\NavNT\
ProcessID : 1788
ThreadCreationTime : 2/8/2006 12:42:47 AM
BasePriority : Normal
FileVersion : 8.00.01.425
ProductVersion : 8.00.01.425
ProductName : Symantec AntiVirus
CompanyName : Symantec Corporation
FileDescription : Symantec AntiVirus
LegalCopyright : Copyright © Symantec Corporation 1991-2002

#:37 [ntsagent.exe]
FilePath : C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\
ProcessID : 1800
ThreadCreationTime : 2/8/2006 12:42:47 AM
BasePriority : Normal
FileVersion : 1.7.4
ProductVersion : 4.6.XXX
ProductName : XTNDConnect PC
CompanyName : Extended Systems Inc.
FileDescription : Lotus Notes translator agent
InternalName : NtsAgnt
LegalCopyright : Copyright © Extended Systems Inc 1998-2000. All rights reserved.
LegalTrademarks : XTNDConnect PC is a trademark of Extended Systems Inc.
OriginalFilename : NtsAgnt.EXE

#:38 [tgcmd.exe]
FilePath : C:\Program Files\Support.com\bin\
ProcessID : 1884
ThreadCreationTime : 2/8/2006 12:42:52 AM
BasePriority : Normal
FileVersion : 5,5,623,0
ProductVersion : 5,5,623,0
ProductName : Support.com Scheduler and Command Dispatcher
CompanyName : Support.com, Inc.
FileDescription : Support.com Scheduler and Command Dispatcher
InternalName : TGCMD
LegalCopyright : Copyright 1997-2069 Support.com
OriginalFilename : TGCMD.EXE

#:39 [jusched.exe]
FilePath : C:\Program Files\Java\j2re1.4.2_06\bin\
ProcessID : 1888
ThreadCreationTime : 2/8/2006 12:42:53 AM
BasePriority : Normal


#:40 [jucheck.exe]
FilePath : C:\Program Files\Java\j2re1.4.2_06\bin\
ProcessID : 1904
ThreadCreationTime : 2/8/2006 12:42:54 AM
BasePriority : Normal
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
ProductName : UpdateChecker Module
FileDescription : UpdateChecker Module
InternalName : UpdateChecker
LegalCopyright : Copyright 2002
OriginalFilename : UpdateChecker.EXE

#:41 [trueimagemonitor.exe]
FilePath : C:\Apps\Acronis\TrueImage\
ProcessID : 1920
ThreadCreationTime : 2/8/2006 12:42:57 AM
BasePriority : Normal
FileVersion : 9,0,0,2324
ProductVersion : 9,0,0,2324
ProductName : Acronis True Image
CompanyName : Acronis
FileDescription : TrueImage
InternalName : TrueImageMonitor
LegalCopyright : Copyright © 2000-2004 Acronis.
LegalTrademarks : Acronis
OriginalFilename : TrueImageMonitor.exe
Comments : Acronis True Image

#:42 [schedhlp.exe]
FilePath : C:\Program Files\Common Files\Acronis\Schedule2\
ProcessID : 1952
ThreadCreationTime : 2/8/2006 12:42:58 AM
BasePriority : Normal
FileVersion : 1,0,0,214
ProductVersion : 1,0,0,214
ProductName : Acronis Scheduler Helper
CompanyName : Acronis
FileDescription : Acronis Scheduler Helper
InternalName : Scheduler Helper
LegalCopyright : Copyright © 2000-2004 Acronis
LegalTrademarks : Acronis
OriginalFilename : schedhlp.exe
Comments : Acronis Scheduler Helper

#:43 [ad-aware.exe]
FilePath : C:\Program Files\lavasoft\Ad-Aware SE Professional\
ProcessID : 1640
ThreadCreationTime : 2/8/2006 12:43:03 AM
BasePriority : Normal
FileVersion : 6.2.0.208
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

#:44 [acrotray.exe]
FilePath : C:\Program Files\Adobe\Distillr\
ProcessID : 1976
ThreadCreationTime : 2/8/2006 12:43:04 AM
BasePriority : Normal
FileVersion : 7.0.1.2005092300
ProductVersion : 7.0.1.2005092300
ProductName : AcroTray - Adobe Acrobat Distiller helper application.
CompanyName : Adobe Systems Inc.
FileDescription : AcroTray
InternalName : AcroTray
LegalCopyright : Copyright 1984-2005 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFilename : AcroTray.exe

#:45 [mmreminderservice.exe]
FilePath : C:\Apps\Mindjet\MindManager6\
ProcessID : 1984
ThreadCreationTime : 2/8/2006 12:43:05 AM
BasePriority : Normal
FileVersion : 6.0.664
ProductVersion : 6.0.664
ProductName : MindManager
CompanyName : Mindjet
FileDescription : MindManager Reminder Services
InternalName : MmReminderService
LegalCopyright : Copyright 1994-2005 Mindjet LLC
LegalTrademarks : MindManager is a registered trademark of Mindjet LLC.
OriginalFilename : MmReminderService.exe
Comments : MindManager 6

#:46 [pdfsaver3.exe]
FilePath : C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\
ProcessID : 2024
ThreadCreationTime : 2/8/2006 12:43:16 AM
BasePriority : Normal
FileVersion : 3.30.0063
ProductVersion : 3.30
ProductName : PDF-XChange 3.0: pdfSaver by Tracker Software Products Ltd.
CompanyName : Tracker Software Products Ltd.
FileDescription : pdfSaver for PDF-XChange 3.0
InternalName : pdfSaver
LegalCopyright : Copyright © 2001-2004 by Tracker Software Products Ltd.
LegalTrademarks : Tracker Software Products Ltd.
OriginalFilename : pdfSaver3.exe
Comments : PDF-XChange 3.0: pdfSaver

#:47 [acrobat_sl.exe]
FilePath : C:\Program Files\Adobe\Acrobat\
ProcessID : 1808
ThreadCreationTime : 2/8/2006 12:43:20 AM
BasePriority : Normal
FileVersion : 7.0.5.2005092300
ProductVersion : 7.0.5.2005092300
ProductName : Adobe Acrobat
CompanyName : Adobe Systems Incorporated
FileDescription : Adobe Acrobat SpeedLauncher
LegalCopyright : Copyright 1984-2005 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFilename : AcroSpeedLaunch.exe

#:48 [psnlite.exe]
FilePath : C:\Apps\Tools\3M\PSNLite\
ProcessID : 2044
ThreadCreationTime : 2/8/2006 12:43:26 AM
BasePriority : Normal
FileVersion : 3, 0, 1, 1070
ProductVersion : 3, 0, 1, 1070
ProductName : Post-it® Software Notes Lite
CompanyName : 3M
FileDescription : Post-it® Software Notes: System
InternalName : PSN
LegalCopyright : © 1995-2004 3M Company. All Rights Reserved.
LegalTrademarks : "Post-it" and canary yellow are a registered trademarks of 3M.
OriginalFilename : PSN2VIEW.EXE

#:49 [ymsgr_tray.exe]
FilePath : C:\Apps\Yahoo\Messenger\
ProcessID : 2068
ThreadCreationTime : 2/8/2006 12:43:29 AM
BasePriority : Normal


#:50 [pull.exe]
FilePath : C:\Program Files\Interwise\Student\
ProcessID : 2084
ThreadCreationTime : 2/8/2006 12:43:30 AM
BasePriority : Normal
FileVersion : 5.2.30
ProductVersion : 5.2.30
ProductName : Interwise PushClient
CompanyName : Interwise Ltd
FileDescription : Interwise PushClient
InternalName : PushClient
LegalCopyright : Copyright © 1996 - 2004 Interwise, Inc.
OriginalFilename : PULL.EXE

#:51 [psngive.exe]
FilePath : C:\Apps\Tools\3M\PSNLite\
ProcessID : 2100
ThreadCreationTime : 2/8/2006 12:43:32 AM
BasePriority : Normal
FileVersion : 3, 0, 2, 2070
ProductVersion : 3, 0, 2, 2070
ProductName : Post-it® Software Notes
CompanyName : 3M
FileDescription : Post-it® Software Notes: GiveNote
InternalName : PSN
LegalCopyright : © 1995-2004 3M Company. All Rights Reserved.
LegalTrademarks : "Post-it" and canary yellow are a registered trademarks of 3M.
OriginalFilename : PSN.EXE

#:52 [hotsync.exe]
FilePath : C:\Palm\
ProcessID : 2120
ThreadCreationTime : 2/8/2006 12:43:33 AM
BasePriority : Normal
FileVersion : 4.0.2
ProductVersion : 4.0.2
ProductName : HotSync® Manager, Palm Desktop
CompanyName : Palm, Inc.
FileDescription : HotSync® Manager Application
InternalName : HotSync®
LegalCopyright : Copyright © 1995-2001 Palm, Inc.
LegalTrademarks : HotSync® is a registered trademark of Palm, Inc.
OriginalFilename : Hotsync.exe

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Alexa Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

Alexa Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : clsid

Alexa Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : Default Visible

Windows Object Recognized!
Type : RegData
Data :
Category : Vulnerability
Comment : Possible unwanted enabling of browser button restriction ability
Rootkey : HKEY_USERS
Object : S-1-5-21-643258023-30832913-1542849698-33350\software\microsoft\windows\currentversion\policies\explorer
Value : SpecifyDefaultButtons
Data :

Windows Object Recognized!
Type : RegData
Data :
Category : Vulnerability
Comment : Possible unwanted block of media button
Rootkey : HKEY_USERS
Object : S-1-5-21-643258023-30832913-1542849698-33350\software\microsoft\windows\currentversion\policies\explorer
Value : Btn_Media
Data :

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 5
Objects found so far: 5


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5



Deep scanning and examining files…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\WINNT
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5

Disk Scan Result for C:\WINNT\system32
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5

Disk Scan Result for C:\DOCUME~1\acheema\LOCALS~1\Temp\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5


Scanning Hosts file……
Hosts file location:"C:\WINNT\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 5



MRU List Object Recognized!
Location: : C:\Documents and Settings\acheema\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office


MRU List Object Recognized!
Location: : C:\Documents and Settings\acheema\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : S-1-5-21-643258023-30832913-1542849698-33350\software\google\navclient\1.1\history
Description : list of recently used search terms in the google toolbar


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-643258023-30832913-1542849698-33350\software\microsoft\ntbackup\log files
Description : list of recent logfiles in microsoft backup


MRU List Object Recognized!
Location: : S-1-5-21-643258023-30832913-1542849698-33350\software\microsoft\office\9.0\common\open find\microsoft word\settings\save as\file name mru
Description : list of recent documents saved by microsoft word


MRU List Object Recognized!
Location: : S-1-5-21-643258023-30832913-1542849698-33350\software\microsoft\windows\currentversion\applets\wordpad\recent file list
Description : list of recent files opened using wordpad


MRU List Object Recognized!
Location: : S-1-5-21-643258023-30832913-1542849698-33350\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened


MRU List Object Recognized!
Location: : S-1-5-21-643258023-30832913-1542849698-33350\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension


MRU List Object Recognized!
Location: : S-1-5-21-643258023-30832913-1542849698-33350\software\nico mak computing\winzip\filemenu
Description : winzip recently used archives


MRU List Object Recognized!
Location: : S-1-5-21-643258023-30832913-1542849698-33350\software\microsoft\windows media\wmsdk\general
Description : windows media sdk



Performing conditional scans…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 18

4:47:29 PM Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:00:28.591
Objects scanned:53032
Objects identified:5
Objects ignored:0
New critical objects:5
___________________________________________________________________