Download Ewido Security Suite it is a trial version of the program.
- Install ewido security suite
- Launch ewido, there should be an icon on your desktop double-click it.
- The program will now go to the main screen
You will need to update ewido to the latest definition files.- On the left hand side of the main screen click update
- Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates
Once the updates are installed do the following:- Click on scanner
- Click on Complete System Scan and the scan will begin.
- During some scans with ewido it is finding cases of false positives.
- You will need to step through the process of cleaning files one-by-one.
- If ewido detects a file you KNOW to be legitimate, select none as the action.
- DO NOT select "Perform action on all infections"
- If you are unsure of any entry found select none for now.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report
Click Save report.
Save the report .txt file to your desktop.
Now close ewido security suite and post the results here.
With a new hijackthis log.
Logfile of HijackThis v1.99.1
Scan saved at 21:25:46, on 06/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\My Music\iTunesHelper.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\windows\system32\dncwleujr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.co.uk/
O4 - HKLM\..\Run: [iTunesHelper] C:\My Music\iTunesHelper.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dncwleujr] c:\windows\system32\dncwleujr.exe dncwleujr
O4 - HKLM\..\RunOnce: [MRUBlaster] C:\Program Files\MRU-Blaster\indexcleaner.exe -CACHE
O4 - Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft....k/?linkid=48835
O17 - HKLM\System\CCS\Services\Tcpip\..\{C779B839-BCAF-4453-AC32-AC6EF8DB3C5A}: NameServer = 212.159.6.9 212.159.6.10
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 21:25:11, 06/03/2006
+ Report-Checksum: FA1A1DBB
+ Scan result:
[800] VM_10001000 -> Adware.NaviPromo : Ignored
C:\Documents and Settings\Angela\Local Settings\Temporary Internet Files\Content.IE5\I9CZ83QX\script-9[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Ignored
C:\Program Files\PestPatrol\Quarantine\20041228214313341.zip/WINDOWS/system32/version.exe -> Adware.DealHelper : Ignored
C:\Program Files\PestPatrol\Quarantine\20050105215036.zip/WINDOWS/system32/version.exe -> Adware.DealHelper : Ignored
C:\Program Files\PestPatrol\Quarantine\2423 -> Adware.EZula : Ignored
C:\WINDOWS\Downloaded Program Files\HDPlugin1018.dll -> Adware.Gator : Ignored
C:\WINDOWS\SYSTEM32\playa.exe -> Adware.WinFetcher : Ignored
C:\WINDOWS\SYSTEM32\Uninstaller.exe -> Adware.DealHelper : Ignored
[824] VM_10001000 -> Adware.NaviPromo : Error during cleaning
[868] VM_10001000 -> Adware.NaviPromo : Error during cleaning
[880] VM_10001000 -> Adware.NaviPromo : Error during cleaning
[888] VM_10001000 -> Adware.NaviPromo : Error during cleaning
[1036] VM_10001000 -> Adware.NaviPromo : Error during cleaning
[1084] C:\WINDOWS\system32\msclock32.dll -> Adware.NaviPromo : Cleaned with backup
[1144] VM_10001000 -> Adware.NaviPromo : Error during cleaning
[1248] C:\WINDOWS\system32\msclock32.dll -> Adware.NaviPromo : Error during cleaning
[1292] C:\WINDOWS\system32\msclock32.dll -> Adware.NaviPromo : Error during cleaning
[1392] VM_10001000 -> Adware.NaviPromo : Error during cleaning
[1528] VM_00E81000 -> Adware.NaviPromo : Error during cleaning
[1628] C:\WINDOWS\system32\msclock32.dll -> Adware.NaviPromo : Error during cleaning
[1656] VM_00CB1000 -> Adware.NaviPromo : Error during cleaning
[1964] VM_00B31000 -> Adware.NaviPromo : Error during cleaning
[556] VM_00FB1000 -> Adware.NaviPromo : Error during cleaning
[572] VM_01861000 -> Adware.NaviPromo : Error during cleaning
[616] VM_00A81000 -> Adware.NaviPromo : Error during cleaning
[648] VM_021B1000 -> Adware.NaviPromo : Error during cleaning
[468] VM_10001000 -> Adware.NaviPromo : Error during cleaning
C:\Documents and Settings\GlenH\Cookies\glenh@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\GlenH\Cookies\glenh@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP163\A0026003.exe -> Dialer.PluginAccess : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP176\A0031511.exe -> Dialer.Holistyc : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP177\A0031673.exe -> Dialer.Holistyc : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP177\A0031680.exe -> Dialer.Holistyc : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP180\A0038971.exe -> Dialer.Juicy : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP181\A0041067.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP181\A0041194.exe -> Dialer.Holistyc : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP181\A0043322.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP182\A0047324.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP182\A0047578.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP182\A0047616.exe -> Downloader.Swizzor.cg : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP182\A0047618.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP187\A0047842.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP187\A0048071.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP187\A0050105.exe -> Downloader.Swizzor.cg : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP187\A0050108.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP187\A0050133.exe -> Downloader.Swizzor.cg : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP187\A0050135.exe -> Adware.WinFetcher : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP190\A0053024.dll -> Adware.WinComm : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP190\A0053025.exe -> Adware.WinAD : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP193\A0056529.vxd -> Adware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP193\A0056533.vxd/C:/WINDOWS/system32/exul.exe -> Adware.BargainBuddy : Error during cleaning
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP193\A0056533.vxd/C:/WINDOWS/system32/javexulm.vxd -> Adware.BargainBuddy : Error during cleaning
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP195\A0057274.dll -> Adware.WinComm : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP195\A0057275.exe -> Adware.WinAD : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP203\A0058201.exe -> Dropper.Small.nt : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP203\A0059290.exe -> Dropper.Small.nt : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP207\A0061632.exe -> Dropper.Small.nt : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP220\A0062329.exe -> Adware.WinAD : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP220\A0062353.dll -> Adware.WinComm : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP220\A0062359.exe -> Downloader.Keenval : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP228\A0071128.exe -> Proxy.Agent.cj : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP243\A0090650.exe -> Adware.WinAD : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP243\A0097137.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP243\A0098137.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP243\A0098242.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP244\A0098292.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP244\A0098299.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098316.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098324.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098334.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098363.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098370.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098384.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098391.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098398.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098415.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098424.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098435.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0098443.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0099443.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0099457.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0099469.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0099476.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0099499.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0099520.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0099534.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0100534.dll -> Adware.NaviPromo : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP245\A0101530.dll -> Adware.NaviPromo : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\search.inf -> Hijacker.StartPage : Cleaned with backup
C:\WINDOWS\SYSTEM32\7k40_static_keycode_minime_7k40_pk2_int__2004_8_3__14_8_16_minime_morphed.exe -> Downloader.Swizzor.cg : Cleaned with backup
C:\WINDOWS\SYSTEM32\HeidiNorthcott_11yf05fg.exe -> Dropper.Small.nt : Cleaned with backup
C:\WINDOWS\SYSTEM32\mbbi8016.dll -> Adware.BargainBuddy : Cleaned with backup
::Report End