18 replies to this topic

[Larsa]

Hello. My computer has just been very sluggish, so I took some advice of my friend and decided to run HijackThis. Thank you in advance for the help.

Logfile of HijackThis v1.99.1
Scan saved at 2:14:13 PM, on 3/7/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RioMSC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Windows AdControl\WinAdCtl.exe
C:\WINDOWS\System32\ndllzxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows AdControl\WinAdAlt.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\sysreset\mirc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\User\Desktop\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mst3k.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://db.gamefaqs.c...00_story_na.txt
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1FFC335D-E76D-27C7-8755-6C550EDF724C} - (no file)
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\System32\BhoCitUS.dll
O2 - BHO: PowerSearch - {4E7BD74F-2B8D-469E-A3FA-F161A787AD2D} - C:\PROGRA~1\POWERS~2\Toolbar\pwrsmnd1\pwrsmnd1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-A3FA-F161A787AD2D} - C:\PROGRA~1\POWERS~2\Toolbar\pwrsmnd1\pwrsmnd1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\PROGRA~1\DAP\dapiebar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [zocvptz] C:\WINDOWS\System32\ndllzxy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: SirSearch - file://C:\Program Files\PWRSMND1\Cache\SelectedContextSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\System32\RioMSC.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[LDTate]

Hello Larsa, Welcome to the forum.

This is what I suggest you do.


Please do not delete anything unless instructed to.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
-- Click the Gear wheel at the top of the Ad-Aware window
-- Click General > Safety & Settings: Check (Green) all three.
-- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Next:

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

[Larsa]

Hello, and thanks for all the help!

At the moment, my computer is running fine and seems to be a bit faster than before.

HijackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 5:29:22 PM, on 3/25/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RioMSC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Documents and Settings\Stacey\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mst3k.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://db.gamefaqs.c...00_story_na.txt
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1FFC335D-E76D-27C7-8755-6C550EDF724C} - (no file)
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\System32\BhoCitUS.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\PROGRA~1\DAP\dapiebar.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [zocvptz] C:\WINDOWS\System32\ndllzxy.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\System32\RioMSC.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Spy Sweeper Log

********
4:25 PM: | Start of Session, Saturday, March 25, 2006 |
4:25 PM: Spy Sweeper started
4:25 PM: Sweep initiated using definitions version 641
4:25 PM: Starting Memory Sweep
4:28 PM: Memory Sweep Complete, Elapsed Time: 00:03:00
4:28 PM: Starting Registry Sweep
4:28 PM: Found Trojan Horse: 2nd-thought
4:28 PM: HKCR\clsid\{8940e505-72c6-44de-be85-1d746780efbf}\ (10 subtraces) (ID = 101977)
4:28 PM: HKCR\interface\{6e0ed53c-9908-49ed-b055-7cb31b162577}\ (7 subtraces) (ID = 101978)
4:28 PM: HKCR\interface\{8c53bd8e-b12d-4c8f-ad0e-c9ddc39d1273}\ (8 subtraces) (ID = 101979)
4:28 PM: HKCR\interface\{9bcdd51b-4a7b-446c-8452-d32d38004582}\ (7 subtraces) (ID = 101980)
4:28 PM: HKCR\interface\{49db48ff-02b5-4645-b676-94a4df1aa026}\ (7 subtraces) (ID = 101981)
4:28 PM: HKCR\interface\{830d3aed-2fa9-454f-b266-d931862bbf34}\ (7 subtraces) (ID = 101982)
4:28 PM: HKCR\interface\{a986f4db-792e-4571-8974-0bb6e024766f}\ (7 subtraces) (ID = 101983)
4:28 PM: HKCR\interface\{bccab53d-0895-40c3-a942-a03538ce227a}\ (7 subtraces) (ID = 101984)
4:28 PM: HKCR\interface\{c0f88e9e-dceb-4655-968a-ae508a677c39}\ (7 subtraces) (ID = 101985)
4:28 PM: HKCR\interface\{d7eac2d8-2d52-4010-a4ad-dfdf60c1706c}\ (7 subtraces) (ID = 101986)
4:28 PM: HKLM\software\classes\interface\{6e0ed53c-9908-49ed-b055-7cb31b162577}\ (7 subtraces) (ID = 101993)
4:28 PM: HKLM\software\classes\interface\{8c53bd8e-b12d-4c8f-ad0e-c9ddc39d1273}\ (8 subtraces) (ID = 101994)
4:28 PM: HKLM\software\classes\interface\{9bcdd51b-4a7b-446c-8452-d32d38004582}\ (7 subtraces) (ID = 101995)
4:28 PM: HKLM\software\classes\interface\{49db48ff-02b5-4645-b676-94a4df1aa026}\ (7 subtraces) (ID = 101996)
4:28 PM: HKLM\software\classes\interface\{830d3aed-2fa9-454f-b266-d931862bbf34}\ (7 subtraces) (ID = 101997)
4:28 PM: HKLM\software\classes\interface\{a986f4db-792e-4571-8974-0bb6e024766f}\ (7 subtraces) (ID = 101998)
4:28 PM: HKLM\software\classes\interface\{bccab53d-0895-40c3-a942-a03538ce227a}\ (7 subtraces) (ID = 101999)
4:28 PM: HKLM\software\classes\interface\{c0f88e9e-dceb-4655-968a-ae508a677c39}\ (7 subtraces) (ID = 102000)
4:28 PM: HKLM\software\classes\interface\{d7eac2d8-2d52-4010-a4ad-dfdf60c1706c}\ (7 subtraces) (ID = 102001)
4:28 PM: HKLM\software\classes\swrt01.rt\ (3 subtraces) (ID = 102002)
4:28 PM: HKCR\swrt01.rt\ (3 subtraces) (ID = 102024)
4:28 PM: Found Adware: exact cashback/bargain buddy
4:28 PM: HKLM\software\microsoft\windows\currentversion\app management\arpcache\bargain buddy\ (2 subtraces) (ID = 104023)
4:28 PM: Found Adware: blazefind
4:28 PM: HKLM\software\microsoft\windows\ || vnmispoisn (ID = 104518)
4:28 PM: Found Adware: ist istbar
4:28 PM: HKLM\software\microsoft\windows\currentversion\app management\arpcache\istbaristbar\ (2 subtraces) (ID = 129119)
4:28 PM: Found Adware: 180search assistant/zango
4:28 PM: HKLM\software\180solutions\ (ID = 135618)
4:28 PM: Found System Monitor: system spy
4:28 PM: HKCR\.ssa\ (1 subtraces) (ID = 143523)
4:28 PM: Found Adware: virtualbouncer
4:28 PM: HKLM\software\classes\clsid\{8940e505-72c6-44de-be85-1d746780efbf}\ (10 subtraces) (ID = 145549)
4:28 PM: HKLM\software\classes\typelib\{5e594162-60a9-487d-84b8-dbdd716cb862}\ (9 subtraces) (ID = 145551)
4:28 PM: HKCR\typelib\{5e594162-60a9-487d-84b8-dbdd716cb862}\ (9 subtraces) (ID = 145565)
4:28 PM: Found Adware: winad
4:28 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/winadx.dll\ (1 subtraces) (ID = 147198)
4:28 PM: HKCR\clsid\{8551311d-f3bf-4718-ad66-96e302500735}\ (12 subtraces) (ID = 392235)
4:28 PM: HKLM\software\classes\clsid\{8551311d-f3bf-4718-ad66-96e302500735}\ (12 subtraces) (ID = 476604)
4:28 PM: Found Adware: keenvalue/perfectnav
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\microsoft\internet explorer\menuext\sirsearch\ (3 subtraces) (ID = 129441)
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\microsoft\internet explorer\toolbar\webbrowser\ || {4e7bd74f-2b8d-469e-a3fa-f161a787ad2d} (ID = 129464)
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\pwrsmnd1\ (6 subtraces) (ID = 129518)
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\msbb\ (14 subtraces) (ID = 135781)
4:28 PM: Found Adware: ist sidefind
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\microsoft\internet explorer\explorer bars\{8cba1b49-8144-4721-a7b1-64c578c9eed7}\ (1 subtraces) (ID = 141777)
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\microsoft\internet explorer\extensions\cmdmapping\ || {10e42047-deb9-4535-a118-b3f6ec39b807} (ID = 141778)
4:28 PM: Found Adware: tvmedia
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\microsoft\internet explorer\urlsearchhooks\ || {707e6f76-9ffb-4920-a976-ea101271bc25} (ID = 145310)
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\microsoft\windows\currentversion\run\ || tv media (ID = 145312)
4:28 PM: Found Adware: twain-tech
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\mxtarget\ (28 subtraces) (ID = 145343)
4:28 PM: Found Adware: webrebates
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\microsoft\internet explorer\menuext\web rebates\ (2 subtraces) (ID = 146297)
4:28 PM: Found Adware: sidesearch
4:28 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1006\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
4:28 PM: Found Adware: cws-aboutblank
4:28 PM: HKU\S-1-5-21-329068152-926492609-725345543-1005\software\microsoft\internet explorer\main\ || search bar_bak (ID = 115924)
4:28 PM: HKU\S-1-5-21-329068152-926492609-725345543-1005\software\microsoft\internet explorer\main\ || search page_bak (ID = 115925)
4:28 PM: HKU\S-1-5-21-329068152-926492609-725345543-1005\software\intermixmedia\ (2 subtraces) (ID = 129439)
4:28 PM: HKU\S-1-5-21-329068152-926492609-725345543-1005\software\microsoft\internet explorer\menuext\sirsearch\ (3 subtraces) (ID = 129441)
4:28 PM: HKU\S-1-5-21-329068152-926492609-725345543-1005\software\pwrsmnd1\ (7 subtraces) (ID = 129518)
4:28 PM: HKU\S-1-5-21-329068152-926492609-725345543-1005\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
4:28 PM: HKU\S-1-5-21-329068152-926492609-725345543-1005\software\microsoft\internet explorer\main\ || search page_bak (ID = 774883)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\microsoft\internet explorer\menuext\sirsearch\ (3 subtraces) (ID = 129441)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\microsoft\internet explorer\toolbar\webbrowser\ || {4e7bd74f-2b8d-469e-a3fa-f161a787ad2d} (ID = 129464)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\pwrsmnd1\ (8 subtraces) (ID = 129518)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\180solutions\ (ID = 135617)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\msbb\ (11 subtraces) (ID = 135781)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\microsoft\internet explorer\explorer bars\{8cba1b49-8144-4721-a7b1-64c578c9eed7}\ (1 subtraces) (ID = 141777)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\microsoft\internet explorer\extensions\cmdmapping\ || {10e42047-deb9-4535-a118-b3f6ec39b807} (ID = 141778)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\microsoft\internet explorer\urlsearchhooks\ || {707e6f76-9ffb-4920-a976-ea101271bc25} (ID = 145310)
4:29 PM: HKU\WRSS_Profile_S-1-5-21-329068152-926492609-725345543-1004\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
4:29 PM: Registry Sweep Complete, Elapsed Time:00:00:36
4:29 PM: Starting Cookie Sweep
4:29 PM: Found Spy Cookie: atwola cookie
4:29 PM: james@atwola[1].txt (ID = 2255)
4:29 PM: Found Spy Cookie: yieldmanager cookie
4:29 PM: james@ad.yieldmanager[2].txt (ID = 3751)
4:29 PM: stacey@ar.atwola[2].txt (ID = 2256)
4:29 PM: stacey@atwola[2].txt (ID = 2255)
4:29 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
4:29 PM: Starting File Sweep
4:29 PM: Warning: Failed to open file "c:\hiberfil.sys". Access is denied
4:29 PM: Warning: Failed to open file "c:\pagefile.sys". Access is denied
4:32 PM: Found Adware: addestroyer
4:32 PM: inneradinstall.log (ID = 49035)
4:33 PM: installpreinstall_p1.exe (ID = 70545)
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\system.log". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\software.log". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\default.log". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\security". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\sam". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\sam.log". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\security.log". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\system". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\software". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\config\default". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\drivers\sptd7101.sys". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\drivers\sptd.sys". The process cannot access the file because it is being used by another process
4:33 PM: Warning: Failed to open file "c:\windows\system32\drivers\dtscsi.sys". The process cannot access the file because it is being used by another process
4:41 PM: Found Adware: directrevenue-abetterinternet
4:41 PM: alchem.inf (ID = 83109)
4:41 PM: polmx.inf (ID = 81856)
4:53 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat.log". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat.log". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse7c640b5-d2aa-4f77-8e3f-7ff0a12081c2.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7d8fab10-7635-420a-9a2d-247a5856a2f2.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7d308376-5965-4b62-831e-642466f56e41.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4e06c5f6-b4e5-4caf-a379-46c204e9f792.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7cacdbf2-bea9-40d5-9d63-adc6db4fffcf.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0a44261a-911f-4372-bac1-1ab2715ba8b7.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa8df8e5c-48be-4f8e-bd17-40c4c354e365.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs81f08e22-fce6-4496-87ee-60a6164c3535.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7ec77b48-e7e9-4890-b92d-767642f9368a.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbca434c9-961f-4809-8e02-20b6b57eed03.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs63e4672a-c2ca-4f2c-a522-9ff6451322c6.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf1ff8bd5-f90b-4666-b40a-15bc41f213ea.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb9898a07-d8f4-4c93-a55d-53985a2771fb.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7cc3c4bc-6dd3-4cca-ba32-da1f1b78f734.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs25d07fe1-ad74-416b-b74a-1bd8a337a4b0.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb5fbe103-7ce4-41cc-ba2c-78f360c53362.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs028faf2d-ee38-4d39-a37b-7c79713f9eb5.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf6beded8-c9d7-46b5-9efc-52c823832fe3.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd466d2c0-68f2-4199-86bb-833c83882ee7.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd2c5d767-ad19-4dcb-832c-6cc0dd341e91.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsaf27fdf7-5610-420d-b231-25cbec548f49.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9b490a6d-59d2-422a-a349-88719c6706bb.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs94904d27-c63e-40c7-a629-f6149f5e03b2.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs81f947db-3ed1-4743-a5a0-21a894c241a8.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc5aa1127-8ce1-4d32-b8ca-682978c21d60.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs40662551-f141-4f4c-9f1b-bde83f015893.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5b8e9c41-1901-4073-9d7b-df5902071e2c.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs44059e3f-71d7-4790-9afa-2690a2f291eb.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0270e7f8-085d-4f2e-b44c-13c9e6c5fca0.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1c3d67e5-b837-4499-828a-7ae8efa5a3f1.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa265d3f9-0020-4b78-9652-0dd6256f5514.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd6db3984-fa3b-4386-9e1c-3b560b37ff3f.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3f9f286b-0cd7-4c19-95e5-9923a3ca6a42.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbe2d670e-1d1c-4646-94af-787faded1679.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5ae7728d-9faa-48e0-ae9e-10650fd43826.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse4a2155f-9189-46f1-8726-e321b5dbb47c.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6a7de315-71de-42ea-95d2-a7e9b2a85830.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa5ceead7-3405-45a3-ba2c-80d39462f06b.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8f328fd0-5229-418d-bf5d-3785f407cf30.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs758bd6da-1c7f-468c-85cc-b64487d3acc7.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3e94bff0-3d42-43d3-b56c-52c43a83f1eb.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs66ffaa3c-4683-43c4-8cbd-980840ecdf41.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs09fa7bb5-4ca7-4978-af76-8d78f97a93b9.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0f6871fb-4c71-4b51-b28a-37f5e8690fa8.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsff6397a2-a360-437d-ae04-eb08a47b2e44.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8fd8082a-5616-4615-b3c5-36db4b540b9c.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs530dd210-7477-483c-b033-17c92913a6f7.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd508aa8d-0976-4707-89b1-367d438dea06.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsaf2a7348-e45e-48ed-81f4-378b2153c881.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3e92058f-996a-4123-9e5c-6e0986cc7023.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb4630d77-21e1-4d9a-9496-5905d7986173.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs428c0dc2-5fac-4ecf-8782-48b759a1bf76.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsbee98f89-b956-42d4-9540-dd68fa62921a.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8cd509cd-8209-4a90-8434-767c1490dd64.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0c7f059c-66ba-4d82-8c2a-48a0c1847b75.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6a2e34ee-833a-4f73-a278-68afb4f8e5ee.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs518624d5-afe1-4c12-9c17-424fa60bc155.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs47b0bd13-8cca-4832-b38f-c33bb361ac23.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs171767b4-d7a9-4278-ac3c-0cbc262de1a9.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs942012d9-3abe-4fdd-b912-ab16b8f4ee45.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa0151ede-9fbc-40a3-afe0-d1c85845ef12.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsde60701f-04ef-4ebd-995d-e8d42b25a3db.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5a24bb40-3cfd-466c-8d05-2d3f35efccf0.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs00e04b25-88f6-4da0-b9bc-b6100e42c89b.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc1a55be7-e234-400a-8cc4-4714486715ac.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf0f83b38-0d7b-4143-983b-fa64f03a7e12.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsca7028eb-629f-4a1c-9982-41b3ea0cc5fe.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1f73ac90-849d-4de5-8649-e6eb58336e55.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs44ee2ea4-47fc-4a0d-a13c-ffca0a7a0fb6.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs2a1b57c8-3942-4fe4-9eb4-06c99aba3837.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs70a4ea8a-77dc-45e0-9685-0d063e4a5514.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsab4844a2-9566-4eb7-bd52-d951953ece2e.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsaef69b67-95ea-46fe-babd-da41db722ddd.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs76a85533-0c9d-4dd3-876b-124f0f994180.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs488261ba-5306-446e-8ddd-74362e0309ac.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscd6c25f9-d447-448c-95f6-b47e8672dda8.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs31987f65-e20d-422d-aae1-e181028df1fa.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs63502807-0206-4de2-946a-6f239bba86db.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfc5c3523-26d9-426a-9e44-d24a297a2ed8.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs04bf9dd3-62f3-4162-ba5d-53a657b5c063.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs371598a8-334d-4c5d-8abd-1016fb11da6d.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf70a49f9-f18f-44a8-8727-e81c28933fbd.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsacd94da8-fb40-4a02-90a2-41fc0e32e084.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsee50b0cf-5850-480b-b668-7c51209ed854.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs2a3e11df-a2dc-481b-b9cc-16891948816f.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4e651429-6b79-492c-8df8-1f75215cb60e.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9db848aa-5d7b-4d20-9aca-f3bb6851dca5.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4a0fccc1-50a5-4906-9d26-fe671112a4d7.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs92bd030d-a7d1-4988-9938-2c01d144dbe0.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs21b05950-00c3-47c8-ae3e-a5376ccc8bbb.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd148569d-778b-4cd2-80b9-62a5453752eb.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs171d1ff1-9b1d-4ceb-9658-bc5f53dac910.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs9dd75fae-50fc-4411-a287-b0f39208b5e8.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5181a765-c605-4804-b755-75194a2c6f39.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfe09f22a-3820-4e5f-bdb3-7e25a31fea52.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscc88ec67-0661-4aa6-bb50-076a68abb018.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs02dcc30b-67be-4a4b-a378-f5ea6bd4dd95.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscdfbd97f-d27e-4b1e-93e0-e17e5b589b3f.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs19bdbb09-de36-4cd2-9f31-981c1aa931e0.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs74d434b9-e9fd-4ac6-a42b-2f7d20241818.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6acb5563-7367-4167-b4d4-8f6e2893a9eb.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs2bba0f06-8728-456f-a938-5947371a14e6.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse9500806-638c-475d-a92f-8cbb4aeb7415.tmp". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfecd4678-aefe-48e1-83c8-9fcbcca41dd4.tmp". The process cannot access the file because it is being used by another process
4:53 PM: lycos sidesearch.lnk (ID = 76058)
4:53 PM: Warning: Failed to open file "c:\documents and settings\stacey\ntuser.dat". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to open file "c:\documents and settings\stacey\ntuser.dat.log". The process cannot access the file because it is being used by another process
4:53 PM: Found Adware: apropos
4:53 PM: exec.exe (ID = 50118)
4:54 PM: Warning: Failed to open file "c:\documents and settings\stacey\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
4:54 PM: Warning: Failed to open file "c:\documents and settings\stacey\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
5:00 PM: Warning: Failed to open file "c:\program files\common files\symantec shared\ccpd-lc\symlcrst.dll". The process cannot access the file because it is being used by another process
5:08 PM: c:\program files\windows adcontrol (1 subtraces) (ID = -2147480017)
5:08 PM: winadctl.exe (ID = 90449)
5:12 PM: Warning: Invalid Stream
5:12 PM: Warning: Invalid Stream
5:14 PM: Warning: Unhandled Archive Type
5:15 PM: Warning: Unhandled Archive Type
5:15 PM: Warning: Unhandled Archive Type
5:15 PM: Warning: Unhandled Archive Type
5:16 PM: Warning: Unhandled Archive Type
5:18 PM: Warning: Unhandled Archive Type
5:20 PM: Warning: Invalid Stream
5:20 PM: Warning: Invalid Stream
5:20 PM: Warning: Unhandled Archive Type
5:21 PM: File Sweep Complete, Elapsed Time: 00:52:10
5:21 PM: Full Sweep has completed. Elapsed time 00:55:54
5:21 PM: Traces Found: 363
5:23 PM: Removal process initiated
5:23 PM: Quarantining All Traces: 180search assistant/zango
5:23 PM: Quarantining All Traces: 2nd-thought
5:23 PM: Quarantining All Traces: cws-aboutblank
5:23 PM: Quarantining All Traces: directrevenue-abetterinternet
5:23 PM: Quarantining All Traces: ist istbar
5:23 PM: Quarantining All Traces: system spy
5:23 PM: Quarantining All Traces: apropos
5:23 PM: Quarantining All Traces: blazefind
5:23 PM: Quarantining All Traces: sidesearch
5:23 PM: Quarantining All Traces: winad
5:23 PM: Quarantining All Traces: addestroyer
5:23 PM: Quarantining All Traces: exact cashback/bargain buddy
5:23 PM: Quarantining All Traces: ist sidefind
5:23 PM: Quarantining All Traces: keenvalue/perfectnav
5:23 PM: Quarantining All Traces: tvmedia
5:23 PM: Quarantining All Traces: twain-tech
5:23 PM: Quarantining All Traces: virtualbouncer
5:23 PM: Quarantining All Traces: webrebates
5:23 PM: Quarantining All Traces: atwola cookie
5:23 PM: Quarantining All Traces: yieldmanager cookie
5:24 PM: Removal process completed. Elapsed time 00:01:01

[LDTate]

Please do not delete anything unless instructed to.


1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
Viewpoint Manager


Do you want these 2? If not fix also with HJT:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mst3k.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://db.gamefaqs.c...00_story_na.txt



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file
O2 - BHO: (no name) - {1FFC335D-E76D-27C7-8755-6C550EDF724C} - (no file)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [zocvptz] C:\WINDOWS\System32\ndllzxy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

Close ALL windows and browsers except HijackThis and click "Fix checked"


delete these files if listed:
C:\WINDOWS\System32\ndllzxy.exe


Open C:\Windows\Prefetch\ Delete ALL files in this folder.



Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED PROFILE USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

[Larsa]

My computer still seems to be at the same speed as in my last post.



Logfile of HijackThis v1.99.1
Scan saved at 6:44:33 PM, on 3/25/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RioMSC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Stacey\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mst3k.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\System32\BhoCitUS.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\PROGRA~1\DAP\dapiebar.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\System32\RioMSC.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[LDTate]

lets see if this will help speed it up.

Backup your Registry...
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run...)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL



I recommend you download RegSeeker. Extract it to it's own folder, open and double click RegSeeker.exe to start the program. Maximize the window and click clean registry. Check all sections and click OK. When the scan is complete, verify the backup box in lower left corner is checked and click the select all button, then select all again. Then right click within the search results and select delete. Run it again and again, deleting everything it finds until it finds nothing. Reboot and make sure your programs are working properly, control panel and add/remove programs windows open, etc (basically just do a quick check of everything). In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.

[Larsa]

Well, it seems that RegSeeker thought it'd be a good idea to delete a lot more files than I expected (I only noticed a few of them on the third run-through), including files that still "exist" (though RegSeeker said they did not) and even though I loaded the back-ups, the files aren't appearing. I searched for them in RegSeeker and they say the .zips are there, but they're not, just .logs. I've rebooted a few times, but they still don't appear... Is there any way to get them back, or are they lost forever? I only noticed one directory in particular, but I'm worried it affected more, too. I also try to load my back-up file from the Registry Editor, but each time it says "Some keys are open by the system or other processes."

[LDTate]

You lost me. What files / folders are you tring to restore? And why?

[Larsa]

Some downloaded .zips that I got that I haven't unzipped yet. They were on a temporary site, so I'm not sure I'll be able to get them again.

[LDTate]

Did you do this? In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.

[Larsa]

Yes. I clicked on Backups, opened the only three files there, "CLEAN", and it said the information was added back to the registry. I have rebooted a few times and the files still don't re-appear; just .log files.

[LDTate]

Do you do a file search for them? Is it running better now?

[Larsa]

I did a file search in RegSeeker, and it shows them there, but when I go to the actual folder they're supposed to be in, they're not there. I think it's still at the same speed since I had to re-load the registry files.

[LDTate]

Did you reboot after you restored them?

[Larsa]

Yes; I tried it a couple times, even.