AdAware SEPlus but still problems

Please disable Teatimer or it could block any fixes. Tutorial here >>>> http://russelltexas.com/malware/teatimer.htm

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Install it, and update the definitions to the newest files.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post as well as a bew hijackthis log please.

Step #1

Please download and run Spybot 1.4 & AdAware SE Then follow the instructions in the link below to run.

Spybot & Adaware Tutorial

Step # 2

Then do a virus scan here >>> Trend Micro


Reboot and post a new HiJackThis log.

I ran the Spybot program sucessfully and then tried AdAware SEPlus. AdAware got stuck on c:\garmin\amrbc7. This is a 317MB folder of maps. It did complete on another system with the same folder, files, file size. Here is the log file as far as it ran: Ad-Aware SE Build 1.06r1 Logfile Created on:Saturday, February 18, 2006 9:45:47 PM Using definitions file:SE1R92 14.02.2006 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Definition File: ========================= Definitions File Loaded: Reference Number : SE1R89 24.01.2006 Internal build : 101 File location : C:\Program Files\Lavasoft\Ad-Aware SE Plus\defs.ref File size : 588187 Bytes Total size : 1770467 Bytes Signature data size : 1734546 Bytes Reference data size : 35409 Bytes Signatures total : 49142 CSI Fingerprints total : 1384 CSI data size : 40743 Bytes Target categories : 15 Target families : 825 2-18-2006 5:26:48 PM Performing WebUpdate… Installing Update… Definitions File Loaded: Reference Number : SE1R92 14.02.2006 Internal build : 105 File location : C:\Program Files\Lavasoft\Ad-Aware SE Plus\defs.ref File size : 612293 Bytes Total size : 1843069 Bytes Signature data size : 1808182 Bytes Reference data size : 34375 Bytes Signatures total : 50991 CSI Fingerprints total : 1581 CSI data size : 47541 Bytes Target categories : 15 Target families : 832 2-18-2006 5:27:05 PM Success Update successfully downloaded and installed. Memory + processor status: ========================== Number of processors : 1 Processor architecture : Non Intel Memory available:26 % Total physical memory:261040 kb Available physical memory:66900 kb Total page file size:639800 kb Available on page file:344140 kb Total virtual memory:2097024 kb Available virtual memory:2022872 kb OS:Microsoft Windows XP Professional Service Pack 1 (Build 2600) Ad-Aware SE Settings =========================== Set : Move deleted files to Recycle Bin Set : Safe mode (always request confirmation) Set : Don't log streams smaller than 0 Bytes Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan within archives Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Let Windows remove files in use at next reboot Set : Block pop-ups aggressively Set : Automatically select problematic objects in results lists Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Show splash screen Set : Backup current definitions file before updating Set : Play sound at scan completion if scan locates critical objects 2/18/2006 9:45:47 PM - Scan started. (Full System Scan) Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 732 ThreadCreationTime : 2/18/2006 10:21:45 PM BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 780 ThreadCreationTime : 2/18/2006 10:21:53 PM BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 816 ThreadCreationTime : 2/18/2006 10:21:59 PM BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 860 ThreadCreationTime : 2/18/2006 10:22:00 PM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 872 ThreadCreationTime : 2/18/2006 10:22:00 PM BasePriority : Normal FileVersion : 5.1.2600.1106 (xpsp1.020828-1920) ProductVersion : 5.1.2600.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [ibmpmsvc.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1040 ThreadCreationTime : 2/18/2006 10:22:00 PM BasePriority : Normal #:7 [ati2evxx.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1080 ThreadCreationTime : 2/18/2006 10:22:02 PM BasePriority : Normal #:8 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1116 ThreadCreationTime : 2/18/2006 10:22:03 PM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1264 ThreadCreationTime : 2/18/2006 10:22:03 PM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [s24evmon.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1348 ThreadCreationTime : 2/18/2006 10:22:04 PM BasePriority : Normal FileVersion : 4, 1, 0, 3 ProductVersion : 4, 1, 0, 3 ProductName : Mobile Unit Support Service CompanyName : Intel Corporation FileDescription : Event Monitor - Supports driver extensions to NIC Driver for wireless adapters. InternalName : S24EvMon LegalCopyright : Copyright © 2001 - 2003 Intel Corporation, 1997 - 2001 Symbol Technologies, Inc. Portions Copyright © MIT OriginalFilename : S24EvMon.exe #:11 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1580 ThreadCreationTime : 2/18/2006 10:22:05 PM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:12 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1640 ThreadCreationTime : 2/18/2006 10:22:05 PM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:13 [ccsetmgr.exe] FilePath : C:\Program Files\Common Files\Symantec Shared\ ProcessID : 1816 ThreadCreationTime : 2/18/2006 10:22:06 PM BasePriority : Normal FileVersion : 2.2.4.003 ProductVersion : 2.2.4.003 ProductName : Common Client CompanyName : Symantec Corporation FileDescription : Common Client Settings Manager Service InternalName : ccSetMgr LegalCopyright : Copyright © 2000-2003 Symantec Corporation. All rights reserved. OriginalFilename : ccSetMgr.exe #:14 [ccevtmgr.exe] FilePath : C:\Program Files\Common Files\Symantec Shared\ ProcessID : 1924 ThreadCreationTime : 2/18/2006 10:22:07 PM BasePriority : Normal FileVersion : 2.2.4.003 ProductVersion : 2.2.4.003 ProductName : Common Client CompanyName : Symantec Corporation FileDescription : Common Client Event Manager Service InternalName : ccEvtMgr LegalCopyright : Copyright © 2000-2003 Symantec Corporation. All rights reserved. OriginalFilename : ccEvtMgr.exe #:15 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 660 ThreadCreationTime : 2/18/2006 10:22:08 PM BasePriority : Normal FileVersion : 5.1.2600.1699 (xpsp2.050610-1533) ProductVersion : 5.1.2600.1699 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:16 [trcboot.exe] FilePath : C:\WINDOWS\System32\drivers\ ProcessID : 1240 ThreadCreationTime : 2/18/2006 10:22:15 PM BasePriority : Normal #:17 [pcs_agnt.exe] FilePath : C:\Program Files\IBM\Personal Communications\ ProcessID : 1560 ThreadCreationTime : 2/18/2006 10:22:18 PM BasePriority : Normal FileVersion : 5060.0.2226.456 ProductVersion : 5.6.0 ProductName : Personal Communications CompanyName : IBM Corporation FileDescription : Always Resident PComm Process InternalName : PCS_AGNT.EXE LegalCopyright : Copyright © IBM Corp. 1989, 2002 LegalTrademarks : ® IBM is a registered trademark of International Business Machines Corporation. Windows™ is a trademark of Microsoft Corporation #:18 [defwatch.exe] FilePath : C:\Program Files\Symantec AntiVirus\ ProcessID : 1652 ThreadCreationTime : 2/18/2006 10:22:20 PM BasePriority : Normal FileVersion : 9.0.5.1000 ProductVersion : 9.0.5.1000 ProductName : Symantec AntiVirus CompanyName : Symantec Corporation FileDescription : Virus Definition Daemon InternalName : DefWatch LegalCopyright : Copyright 1998 - 2004 Symantec Corporation. All rights reserved. OriginalFilename : DefWatch.exe #:19 [ewidoctrl.exe] FilePath : C:\Program Files\ewido anti-malware\ ProcessID : 2000 ThreadCreationTime : 2/18/2006 10:22:21 PM BasePriority : Normal FileVersion : 3, 0, 0, 1 ProductVersion : 3, 0, 0, 1 ProductName : ewido control CompanyName : ewido networks FileDescription : ewido control InternalName : ewido control LegalCopyright : Copyright © 2004 OriginalFilename : ewidoctrl.exe #:20 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2012 ThreadCreationTime : 2/18/2006 10:22:21 PM BasePriority : Normal #:21 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 208 ThreadCreationTime : 2/18/2006 10:22:21 PM BasePriority : Normal FileVersion : 6.00.2800.1221 (xpsp2.030511-1403) ProductVersion : 6.00.2800.1221 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:22 [ewidoguard.exe] FilePath : C:\Program Files\ewido anti-malware\ ProcessID : 236 ThreadCreationTime : 2/18/2006 10:22:22 PM BasePriority : Normal FileVersion : 3, 0, 0, 1 ProductVersion : 3, 0, 0, 1 ProductName : guard CompanyName : ewido networks FileDescription : guard InternalName : guard LegalCopyright : Copyright © 2004 OriginalFilename : guard.exe #:23 [rrpcsb.exe] FilePath : C:\Program Files\IBM\IBM Rapid Restore Ultra\ ProcessID : 264 ThreadCreationTime : 2/18/2006 10:22:24 PM BasePriority : Normal FileVersion : 4,0,0,4026 ProductVersion : 4,0,0,4026 ProductName : rrpcsb Module FileDescription : rrpcsb Module InternalName : rrpcsb LegalCopyright : Copyright 2002 OriginalFilename : rrpcsb.EXE #:24 [isamsmt.exe] FilePath : C:\Program Files\C4ebreg\ ProcessID : 352 ThreadCreationTime : 2/18/2006 10:22:25 PM BasePriority : Normal FileVersion : 1.02 ProductVersion : 1.02 CompanyName : IBM Global Services FileDescription : ISAM Software Metering Tool InternalName : ISAMSMT LegalCopyright : © IBM Global Services, 2002 Comments : Written by: Operating Systems Platforms #:25 [issimsvc.exe] FilePath : c:\sdwork\ ProcessID : 528 ThreadCreationTime : 2/18/2006 10:22:28 PM BasePriority : Normal FileVersion : 2.09 ProductVersion : 2.09 CompanyName : IBM Global Services FileDescription : ISSI EZUpdate Service InternalName : ISSIMSVC LegalCopyright : © IBM Global Services, 2001, 2005 Comments : Written by: Operating Systems Platforms #:26 [netcfgsv.exe] FilePath : C:\PROGRA~1\AT&TNE~1\ ProcessID : 784 ThreadCreationTime : 2/18/2006 10:22:32 PM BasePriority : Normal FileVersion : 5.05.1 ProductVersion : 5.05.1 ProductName : NetCfgSvr Module CompanyName : AT&T FileDescription : Network configuration service InternalName : NetCfgSvr LegalCopyright : Copyright © 2002 AT&T. All Rights Reserved. OriginalFilename : NetCfgSvr.EXE #:27 [qconsvc.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1548 ThreadCreationTime : 2/18/2006 10:22:36 PM BasePriority : Normal FileVersion : 3, 0, 0, 0 ProductVersion : 3, 0, 0, 0 ProductName : IBM ThinkPad Utility CompanyName : IBM Corp. FileDescription : IBM Access Connections - Service Component. InternalName : QConSvc LegalCopyright : Copyright © IBM Corp. 2001, 2004 OriginalFilename : QConSvc.Exe Comments : IBM Access Connections Component. #:28 [regsrvc.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1692 ThreadCreationTime : 2/18/2006 10:22:36 PM BasePriority : Normal FileVersion : 4, 1, 0, 0 ProductVersion : 4, 1, 0, 0 ProductName : RegSrvc Module CompanyName : Intel Corporation FileDescription : RegSrvc Module InternalName : RegSrvc LegalCopyright : Copyright © 2002 - 2003 Intel Corporation OriginalFilename : RegSrvc.EXE #:29 [savroam.exe] FilePath : C:\Program Files\Symantec AntiVirus\ ProcessID : 1756 ThreadCreationTime : 2/18/2006 10:22:37 PM BasePriority : Normal FileVersion : 9.0.5.1000 ProductVersion : 9.0.5.1000 ProductName : Symantec SAVRoam CompanyName : symantec FileDescription : SAVRoam InternalName : SAVRoam LegalCopyright : Copyright 2002 - 2004 Symantec Corporation. All rights reserved. OriginalFilename : SAVRoam.exe #:30 [rtvscan.exe] FilePath : C:\Program Files\Symantec AntiVirus\ ProcessID : 452 ThreadCreationTime : 2/18/2006 10:22:43 PM BasePriority : Normal FileVersion : 9.0.5.1000 ProductVersion : 9.0.5.1000 ProductName : Symantec AntiVirus CompanyName : Symantec Corporation FileDescription : Symantec AntiVirus LegalCopyright : Copyright 1991 - 2004 Symantec Corporation. All rights reserved. #:31 [agrsmmsg.exe] FilePath : C:\WINDOWS\ ProcessID : 572 ThreadCreationTime : 2/18/2006 10:22:44 PM BasePriority : Normal FileVersion : 2.1.31 2.1.31 06/27/2003 08:53:31 ProductVersion : 2.1.31 2.1.31 06/27/2003 08:53:31 ProductName : Agere SoftModem Messaging Applet CompanyName : Agere Systems FileDescription : SoftModem Messaging Applet InternalName : smdmstat.exe LegalCopyright : Copyright © Agere Systems 1998-2000 OriginalFilename : smdmstat.exe #:32 [tphkmgr.exe] FilePath : C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\ ProcessID : 1296 ThreadCreationTime : 2/18/2006 10:22:48 PM BasePriority : Normal #:33 [rundll32.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1368 ThreadCreationTime : 2/18/2006 10:22:48 PM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Run a DLL as an App InternalName : rundll LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : RUNDLL.EXE #:34 [tpkmpsvc.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1344 ThreadCreationTime : 2/18/2006 10:22:48 PM BasePriority : Normal #:35 [wdfmgr.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1428 ThreadCreationTime : 2/18/2006 10:22:50 PM BasePriority : Normal FileVersion : 5.2.3790.1230 built by: DNSRV(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:36 [vsmon.exe] FilePath : C:\WINDOWS\system32\ZoneLabs\ ProcessID : 1572 ThreadCreationTime : 2/18/2006 10:22:50 PM BasePriority : Normal FileVersion : 3.5.175.087 ProductVersion : 3.5.175.087 ProductName : TrueVector Service CompanyName : Zone Labs Inc. FileDescription : TrueVector Service InternalName : vsmon LegalCopyright : Copyright © 1999-2002, Zone Labs Inc. OriginalFilename : vsmon.exe #:37 [tponscr.exe] FilePath : C:\Program Files\ThinkPad\PkgMgr\HOTKEY\ ProcessID : 2128 ThreadCreationTime : 2/18/2006 10:22:58 PM BasePriority : Normal #:38 [syntplpr.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 2164 ThreadCreationTime : 2/18/2006 10:22:59 PM BasePriority : Normal FileVersion : 7.5.17.6 28Aug03 ProductVersion : 7.5.17.6 28Aug03 ProductName : Progressive Touch CompanyName : Synaptics, Inc. FileDescription : TouchPad Driver Helper Application InternalName : SynTPLpr LegalCopyright : Copyright © Synaptics, Inc. 1996-2003 OriginalFilename : SynTPLpr.exe #:39 [tpscrex.exe] FilePath : C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\ ProcessID : 2200 ThreadCreationTime : 2/18/2006 10:23:00 PM BasePriority : Normal FileVersion : 1.06 ProductVersion : 1.06 ProductName : ThinkPad UltraZoom CompanyName : IBM Corporation FileDescription : ThinkPad UltraZoom InternalName : TPSCREX LegalCopyright : Copyright © 2000, IBM Corporation OriginalFilename : TpScrEx.exe #:40 [syntpenh.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 2224 ThreadCreationTime : 2/18/2006 10:23:01 PM BasePriority : Normal FileVersion : 7.5.17.6 28Aug03 ProductVersion : 7.5.17.6 28Aug03 ProductName : Progressive Touch CompanyName : Synaptics, Inc. FileDescription : Synaptics TouchPad Enhancements InternalName : Scrolleroo LegalCopyright : Copyright © Synaptics, Inc. 1996-2003 OriginalFilename : SynTPEnh.exe #:41 [fxssvc.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2272 ThreadCreationTime : 2/18/2006 10:23:02 PM BasePriority : Normal FileVersion : 5.2.1776.1023 ProductVersion : 5.2.1776.1023 ProductName : Microsoft® Fax Server CompanyName : Microsoft Corporation FileDescription : Fax Service InternalName : FXSSVC.EXE LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : FXSSVC.EXE #:42 [ldlcserv.exe] FilePath : C:\WINDOWS\System32\Drivers\ ProcessID : 2356 ThreadCreationTime : 2/18/2006 10:23:05 PM BasePriority : Normal #:43 [c4ebreg.exe] FilePath : C:\progra~1\c4ebreg\ ProcessID : 2376 ThreadCreationTime : 2/18/2006 10:23:06 PM BasePriority : Normal FileVersion : 5.20 ProductVersion : 5.20 CompanyName : IBM Global Services FileDescription : IBM Standard Asset Manager InternalName : C4EBREG LegalCopyright : © IBM Global Services, 2000, 2005 Comments : Written by: Operating Systems Platforms #:44 [qcwlicon.exe] FilePath : C:\PROGRA~1\ThinkPad\CONNEC~1\ ProcessID : 2460 ThreadCreationTime : 2/18/2006 10:23:08 PM BasePriority : Normal FileVersion : 3, 0, 0, 0 ProductVersion : 3, 0, 0, 0 ProductName : IBM ThinkPad Utility CompanyName : IBM Corp. FileDescription : IBM Access Connections - Wireless Status Icon. InternalName : QCWLIcon LegalCopyright : Copyright © IBM Corp. 2001, 2004 OriginalFilename : QCWLIcon.exe Comments : IBM Access Connections Component. #:45 [ntsagent.exe] FilePath : C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\ ProcessID : 2524 ThreadCreationTime : 2/18/2006 10:23:08 PM BasePriority : Normal FileVersion : 2.3.6 ProductVersion : 4.21.XXX ProductName : XTNDConnect PC CompanyName : Extended Systems Inc. FileDescription : Lotus Notes translator agent InternalName : NtsAgnt LegalCopyright : Copyright © Extended Systems Inc 1998-2000. All rights reserved. LegalTrademarks : XTNDConnect PC is a trademark of Extended Systems Inc. OriginalFilename : NtsAgnt.EXE #:46 [blsloader.exe] FilePath : C:\Program Files\BellSouth Internet Tools\ ProcessID : 2628 ThreadCreationTime : 2/18/2006 10:23:12 PM BasePriority : Normal #:47 [ibmprc.exe] FilePath : C:\IBMTOOLS\UTILS\ ProcessID : 2756 ThreadCreationTime : 2/18/2006 10:23:14 PM BasePriority : Normal FileVersion : 1, 0, 0, 3 ProductVersion : 1, 0, 0, 1 ProductName : ibmprc Application CompanyName : IBM Corp. FileDescription : ibmprc Application InternalName : ibmprc LegalCopyright : Copyright © 2004 IBM OriginalFilename : ibmprc.exe #:48 [qttask.exe] FilePath : C:\Program Files\QuickTime\ ProcessID : 2912 ThreadCreationTime : 2/18/2006 10:23:18 PM BasePriority : Normal FileVersion : 6.4 ProductVersion : QuickTime 6.4 ProductName : QuickTime CompanyName : Apple Computer, Inc. InternalName : QuickTime Task LegalCopyright : © Apple Computer, Inc. 2001-2003 OriginalFilename : QTTask.exe #:49 [qctray.exe] FilePath : C:\PROGRA~1\ThinkPad\CONNEC~1\ ProcessID : 3016 ThreadCreationTime : 2/18/2006 10:23:20 PM BasePriority : Normal FileVersion : 3, 0, 0, 0 ProductVersion : 3, 0, 0, 0 ProductName : IBM ThinkPad Utility CompanyName : IBM Corp. FileDescription : IBM Access Connections - Taskbar Application. InternalName : QCTray LegalCopyright : Copyright © IBM Corp. 2001, 2004 OriginalFilename : QCTray.exe Comments : IBM Access Connections Component. #:50 [tfswctrl.exe] FilePath : C:\WINDOWS\system32\dla\ ProcessID : 3024 ThreadCreationTime : 2/18/2006 10:23:21 PM BasePriority : Normal FileVersion : 1.04.08a CompanyName : Sonic Solutions FileDescription : Drive Letter Access Component LegalCopyright : Copyright © 2004 Sonic Solutions #:51 [realsched.exe] FilePath : C:\Program Files\Common Files\Real\Update_OB\ ProcessID : 3076 ThreadCreationTime : 2/18/2006 10:23:22 PM BasePriority : Normal FileVersion : 0.1.0.3208 ProductVersion : 0.1.0.3208 ProductName : RealPlayer (32-bit) CompanyName : RealNetworks, Inc. FileDescription : RealNetworks Scheduler InternalName : schedapp LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004 LegalTrademarks : RealAudio™ is a trademark of RealNetworks, Inc. OriginalFilename : realsched.exe #:52 [isamtray.exe] FilePath : C:\progra~1\c4ebreg\ ProcessID : 3120 ThreadCreationTime : 2/18/2006 10:23:23 PM BasePriority : Normal FileVersion : 5.20 ProductVersion : 5.20 CompanyName : IBM Global Services FileDescription : ISAM Tray Icon InternalName : ISAMTRAY LegalCopyright : © IBM Global Services, 2005 Comments : Written by: Operating Systems Platforms #:53 [ccapp.exe] FilePath : C:\Program Files\Common Files\Symantec Shared\ ProcessID : 3324 ThreadCreationTime : 2/18/2006 10:23:25 PM BasePriority : Normal FileVersion : 2.2.4.003 ProductVersion : 2.2.4.003 ProductName : Common Client CompanyName : Symantec Corporation FileDescription : Common Client User Session InternalName : ccApp LegalCopyright : Copyright © 2000-2003 Symantec Corporation. All rights reserved. OriginalFilename : ccApp.exe #:54 [vptray.exe] FilePath : C:\PROGRA~1\SYMANT~1\ ProcessID : 3628 ThreadCreationTime : 2/18/2006 10:23:32 PM BasePriority : Normal FileVersion : 9.0.5.1000 ProductVersion : 9.0.5.1000 ProductName : Symantec AntiVirus CompanyName : Symantec Corporation FileDescription : Symantec AntiVirus LegalCopyright : Copyright 1991 - 2004 Symantec Corporation. All rights reserved. #:55 [inboxtogo-watch.exe] FilePath : C:\Program Files\Palm\ ProcessID : 3992 ThreadCreationTime : 2/18/2006 10:23:41 PM BasePriority : Normal FileVersion : 100.00 (124) ProductVersion : 100.00 (124) ProductName : DataViz Mail FileDescription : DataViz Mail System Watchdog InternalName : inboxtogo-watch.exe LegalCopyright : Copyright © 1999-2002 DataViz, Inc. OriginalFilename : inboxtogo-watch.exe #:56 [inboxtogo-agent.exe] FilePath : C:\Program Files\Palm\ ProcessID : 972 ThreadCreationTime : 2/18/2006 10:23:42 PM BasePriority : Normal FileVersion : 100.00 (124) ProductVersion : 100.00 (124) ProductName : DataViz Mail FileDescription : DataViz Mail Desktop Agent InternalName : inboxtogo-agent.exe LegalCopyright : Copyright © 1999-2002 DataViz, Inc. OriginalFilename : inboxtogo-agent.exe #:57 [iclient.exe] FilePath : C:\Program Files\Zone Labs\Integrity Client\ ProcessID : 604 ThreadCreationTime : 2/18/2006 10:23:44 PM BasePriority : Normal FileVersion : 3.5.175.087 ProductVersion : 3.5.175.087 ProductName : Integrity Client CompanyName : Zone Labs Inc. FileDescription : Integrity Client InternalName : iclient LegalCopyright : Copyright © 1999-2002, Zone Labs Inc. OriginalFilename : iclient.exe #:58 [hotsync.exe] FilePath : C:\Program Files\Palm\ ProcessID : 1868 ThreadCreationTime : 2/18/2006 10:23:50 PM BasePriority : Normal FileVersion : 4.0.4 ProductVersion : 4.1.0 ProductName : HotSync® Manager, Palm Desktop CompanyName : Palm, Inc. FileDescription : HotSync® Manager Application InternalName : HotSync® LegalCopyright : Copyright © 1995-2001 Palm, Inc. LegalTrademarks : HotSync® is a registered trademark of Palm, Inc. OriginalFilename : Hotsync.exe #:59 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Plus\ ProcessID : 3936 ThreadCreationTime : 2/18/2006 10:24:41 PM BasePriority : Normal FileVersion : 6.2.0.237 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : markgarvin@2o7[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Administrator\Cookies\markgarvin@2o7[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Administrator\Cookies\[removed][2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : markgarvin@bravenet[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Administrator\Cookies\markgarvin@bravenet[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : markgarvin@cgi-bin[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Administrator\Cookies\markgarvin@cgi-bin[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Administrator\Cookies\[removed][2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Administrator\Cookies\[removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : markgarvin@serving-sys[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Administrator\Cookies\markgarvin@serving-sys[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : markgarvin@trafic[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Administrator\Cookies\markgarvin@trafic[1].txt Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 8 Objects found so far: 8

Reboot

Please download Asquared from the link below.

http://www.emsisoft.com/en/software/download/

Safe it to your desktop. Next open and check for updates.

Boot to safe mode (tap f8 while bios loads)

Then scan your system (this will take some time) after the scan is compelte allow it to fix what it has found. If there is something that it can not clean please let me know what it was.

Then reboot and post a new hijackthis log.

Looks ok, how is it running?

It's running great. Thanks for your help siggyx!! This is the only site I've found that can get my computer running again. I sent a donation. Thanks again.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php