14 replies to this topic

[howgain]

Hi All, This is a great board and I've received some excellent help here before. I'm currently trying to clear my In-Law's PC of spyware and they had quite a bit. They are running Windows 2000 Professional Edition. I've used Ad Aware and Scan Spyware so far, and removed some of it. I've also downloaded Spyware Guard. I'll reply with the Hijack This log. Thanks in advance, Danny

[howgain]

Here's the log - thanks again:

Logfile of HijackThis v1.99.1
Scan saved at 7:02:35 PM, on 4/9/2006
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe
C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe
C:\PROGRA~1\IBM\CLIENT~1\cwbbs.exe
C:\PROGRA~1\IBM\CLIENT~1\cwbntred.exe
C:\Program Files\IBM\Client Access\CWBPROVD.EXE
C:\WINNT\Explorer.exe
C:\WINNT\System32\nkopwv.exe
C:\Program Files\IBM\Client Access\cwbuitsk.exe
C:\Program Files\IBM\Client Access\CWBSVD.EXE
C:\PROGRA~1\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
F2 - REG:system.ini: UserInit=C:\PROGRA~1\IBM\CLIENT~1\cwbbs.exe,C:\PROGRA~1\IBM\CLIENT~1\cwbntred.exe,C:\PROGRA~1\IBM\CLIENT~1\cwbprovd.exe,C:\WINNT\system32\userinit.exe,
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: BestOffers Shopping BHO - {F5DE8ADB-4A69-4e56-96AB-823171C8E9D8} - C:\Program Files\TBONAS\TBONlchr.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: BestOffers Shopping v1.20 - {7FD44536-9DF0-4034-939F-5BD4D98E3187} - C:\Program Files\TBONAS\TBONlchr.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [madexe] C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\mad.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\CwbSvStr.Exe"
O4 - HKLM\..\Run: [Client Access Taskbar] "C:\Program Files\IBM\Client Access\cwbuitsk.exe"
O4 - HKLM\..\Run: [Client Access API Daemon] "C:\Program Files\IBM\Client Access\cwbappcd.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [*iptapi] C:\WINNT\system32\NPP\iptapi.exe
O4 - HKLM\..\Run: [*srvbak] C:\WINNT\Config\srvbak.exe
O4 - HKLM\..\Run: [*libvb] C:\WINNT\repair\libvb.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [kOIRqdDR] C:\WINNT\ootftcwp.exe
O4 - HKLM\..\Run: [ùõ€-‚²‘ÆßÎ7bñº@õ‰C:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\ootftcwp.exe
O4 - HKLM\..\Run: [Dinst] C:\WINNT\dinst.exe
O4 - HKLM\..\Run: [twbcjyu] C:\WINNT\System32\nkopwv.exe r
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: &KewlBar Search - res://C:\Program Files\KewlBar 5.0\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O15 - Trusted Zone: http://vsp.closetmaid.com
O16 - DPF: Canasta by pogo - http://game1.pogo.co...nasta-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.co...peaks-en_US.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.co...rols/Rovion.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {666DDE35-E955-11D0-A707-000000521958} - http://69.56.176.227/webplugin.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://aolsvc.aol.co...bugs/axhost.cab
O16 - DPF: {8B6193F1-837F-11D4-89E6-0050DA666184} (Sol2axctl Class) - http://download.soli...d/solitaire.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...0/Installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.co...aploader_v7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7698745-A628-424F-961C-81E08575E312}: NameServer = 192.168.1.1
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Client Access Remote Command (Cwbrxd) - IBM Corporation - C:\WINNT\CWBRXD.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)

[LDTate]

Hello howgain,
You need to get your windows updates. You're 3 service packs behind. You should be on SP4.
Platform: Windows 2000 SP1 (WinNT 5.00.2195)

After you get your updates post a new HijackThis log.

[howgain]

Hello howgain,
You need to get your windows updates. You're 3 service packs behind. You should be on SP4.
Platform: Windows 2000 SP1 (WinNT 5.00.2195)

After you get your updates post a new HijackThis log.

Hi LDTate,

Thanks for getting back to me. I installed SP4, then rebooted. I ran AdAware & Scan Spyware and rebooted again. Then I ran Hijack This and the log is below:


Logfile of HijackThis v1.99.1
Scan saved at 9:20:05 PM, on 4/17/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe
C:\PROGRA~1\IBM\CLIENT~1\cwbbs.exe
C:\PROGRA~1\IBM\CLIENT~1\cwbntred.exe
C:\Program Files\IBM\Client Access\CWBPROVD.EXE
C:\WINNT\Explorer.exe
C:\Program Files\IBM\Client Access\cwbuitsk.exe
C:\Program Files\IBM\Client Access\CWBSVD.EXE
C:\WINNT\system32\zdzarhj.exe
C:\PROGRA~1\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
F2 - REG:system.ini: UserInit=C:\PROGRA~1\IBM\CLIENT~1\cwbbs.exe,C:\PROGRA~1\IBM\CLIENT~1\cwbntred.exe,C:\PROGRA~1\IBM\CLIENT~1\cwbprovd.exe,C:\WINNT\system32\userinit.exe,
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [madexe] C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\mad.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\CwbSvStr.Exe"
O4 - HKLM\..\Run: [Client Access Taskbar] "C:\Program Files\IBM\Client Access\cwbuitsk.exe"
O4 - HKLM\..\Run: [Client Access API Daemon] "C:\Program Files\IBM\Client Access\cwbappcd.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [*iptapi] C:\WINNT\system32\NPP\iptapi.exe
O4 - HKLM\..\Run: [*srvbak] C:\WINNT\Config\srvbak.exe
O4 - HKLM\..\Run: [*libvb] C:\WINNT\repair\libvb.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [kOIRqdDR] C:\WINNT\ootftcwp.exe
O4 - HKLM\..\Run: [ùõ€-‚²‘ÆßÎ7bñº@õ‰C:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\ootftcwp.exe
O4 - HKLM\..\Run: [tnsfywf] C:\WINNT\system32\zdzarhj.exe r
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: &KewlBar Search - res://C:\Program Files\KewlBar 5.0\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O15 - Trusted Zone: http://vsp.closetmaid.com
O16 - DPF: Canasta by pogo - http://game1.pogo.co...nasta-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.co...peaks-en_US.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.co...rols/Rovion.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {666DDE35-E955-11D0-A707-000000521958} - http://69.56.176.227/webplugin.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://aolsvc.aol.co...bugs/axhost.cab
O16 - DPF: {8B6193F1-837F-11D4-89E6-0050DA666184} (Sol2axctl Class) - http://download.soli...d/solitaire.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...0/Installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.co...aploader_v7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7698745-A628-424F-961C-81E08575E312}: NameServer = 192.168.1.1
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Client Access Remote Command (Cwbrxd) - IBM Corporation - C:\WINNT\CWBRXD.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)

[LDTate]

To configure Windows to show all files

Do the following:

On the Windows desktop, double-click the My Computer icon.
On the Tools menu, click Folder Options.
On the View tab, uncheck Hide file extensions for known file types.

Do the following:

Uncheck Hide protected operating system files. Then, under the "Hidden files" folder, click Show hidden files and folders.
If you see a warning message, click Yes.
Click Apply.
Click OK.


Please do not delete anything unless instructed to.


Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

[howgain]

Thanks again LDTate. Here's the latest. First the Hijack This log and then the Spy Sweeper Log:


Logfile of HijackThis v1.99.1
Scan saved at 4:42:23 PM, on 4/18/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe
C:\PROGRA~1\IBM\CLIENT~1\cwbbs.exe
C:\PROGRA~1\IBM\CLIENT~1\cwbntred.exe
C:\Program Files\IBM\Client Access\CWBPROVD.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\IBM\Client Access\cwbuitsk.exe
C:\Program Files\IBM\Client Access\CWBSVD.EXE
C:\PROGRA~1\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
F2 - REG:system.ini: UserInit=C:\PROGRA~1\IBM\CLIENT~1\cwbbs.exe,C:\PROGRA~1\IBM\CLIENT~1\cwbntred.exe,C:\PROGRA~1\IBM\CLIENT~1\cwbprovd.exe,C:\WINNT\system32\userinit.exe,
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [madexe] C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\mad.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\CwbSvStr.Exe"
O4 - HKLM\..\Run: [Client Access Taskbar] "C:\Program Files\IBM\Client Access\cwbuitsk.exe"
O4 - HKLM\..\Run: [Client Access API Daemon] "C:\Program Files\IBM\Client Access\cwbappcd.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [*iptapi] C:\WINNT\system32\NPP\iptapi.exe
O4 - HKLM\..\Run: [*srvbak] C:\WINNT\Config\srvbak.exe
O4 - HKLM\..\Run: [*libvb] C:\WINNT\repair\libvb.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [kOIRqdDR] C:\WINNT\ootftcwp.exe
O4 - HKLM\..\Run: [ùõ€-‚²‘ÆßÎ7bñº@õ‰C:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\ootftcwp.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O15 - Trusted Zone: http://vsp.closetmaid.com
O16 - DPF: Canasta by pogo - http://game1.pogo.co...nasta-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.co...peaks-en_US.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.co...rols/Rovion.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {666DDE35-E955-11D0-A707-000000521958} - http://69.56.176.227/webplugin.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://aolsvc.aol.co...bugs/axhost.cab
O16 - DPF: {8B6193F1-837F-11D4-89E6-0050DA666184} (Sol2axctl Class) - http://download.soli...d/solitaire.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...0/Installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.co...aploader_v7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7698745-A628-424F-961C-81E08575E312}: NameServer = 192.168.1.1
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Client Access Remote Command (Cwbrxd) - IBM Corporation - C:\WINNT\CWBRXD.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)



Spy Sweeper Log:


1:47 PM: | Start of Session, Tuesday, April 18, 2006 |
1:47 PM: Spy Sweeper started
1:47 PM: Sweep initiated using definitions version 659
1:47 PM: Starting Memory Sweep
1:51 PM: Found Adware: directrevenue-abetterinternet
1:51 PM: Detected running threat: C:\WINNT\explorer.exe (ID = 63)
1:54 PM: Detected running threat: C:\WINNT\SYSTEM32\awjyqic.exe (ID = 280398)
1:54 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || wdjjqh (ID = 0)
1:54 PM: Detected running threat: C:\Program Files\IBM\Client Access\cwbntred.exe (ID = 93)
1:55 PM: Detected running threat: C:\Program Files\IBM\Client Access\cwbbs.exe (ID = 93)
1:55 PM: Detected running threat: C:\Program Files\IBM\Client Access\CWBPROVD.exe (ID = 93)
1:55 PM: Detected running threat: C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe (ID = 93)
1:55 PM: Detected running threat: C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe (ID = 93)
1:55 PM: Detected running threat: C:\Program Files\Navnt\vptray.exe (ID = 93)
1:55 PM: Detected running threat: C:\Program Files\IBM\Client Access\cwbuitsk.exe (ID = 93)
1:55 PM: Detected running threat: C:\Program Files\IBM\Client Access\cwbsvd.exe (ID = 93)
1:55 PM: Detected running threat: C:\Program Files\QuickTime\qttask.exe (ID = 93)
1:56 PM: Detected running threat: C:\Program Files\Real\RealPlayer\realplay.exe (ID = 93)
1:56 PM: Detected running threat: C:\Program Files\SpywareGuard\sgmain.exe (ID = 93)
1:56 PM: Detected running threat: C:\Program Files\SpywareGuard\sgbhp.exe (ID = 93)
1:56 PM: Detected running threat: C:\Program Files\Internet Explorer\IEXPLORE.EXE (ID = 93)
1:56 PM: Memory Sweep Complete, Elapsed Time: 00:09:18
1:56 PM: Starting Registry Sweep
1:56 PM: Found Adware: exact fungamedownloads
1:56 PM: HKCR\applications\funcade.exe\ (3 subtraces) (ID = 104002)
1:56 PM: Found Adware: coolsavings
1:56 PM: HKCR\clsid\{11bdb904-c0bc-41ce-910b-0d12fd619fd0}\ (2 subtraces) (ID = 106999)
1:56 PM: HKLM\software\classes\clsid\{11bdb904-c0bc-41ce-910b-0d12fd619fd0}\ (2 subtraces) (ID = 107005)
1:56 PM: Found Adware: gain - common components
1:56 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/winnt/downloaded program files/hdplugin1019.dll\ (2 subtraces) (ID = 126774)
1:56 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\winnt\downloaded program files\hdplugin1019.dll (ID = 126794)
1:56 PM: Found Adware: drsnsrch.com hijack
1:56 PM: HKLM\software\microsoft\internet explorer\main\ || search bar (ID = 128208)
1:56 PM: HKLM\software\microsoft\internet explorer\main\ || search page (ID = 128209)
1:56 PM: HKLM\software\microsoft\internet explorer\search\ || customizesearch (ID = 128210)
1:56 PM: HKLM\software\microsoft\internet explorer\search\ || searchassistant (ID = 128211)
1:56 PM: HKLM\system\currentcontrolset\control\print\monitors\zepmon\ (1 subtraces) (ID = 146139)
1:56 PM: HKLM\system\currentcontrolset\services\svcproc\ (12 subtraces) (ID = 146140)
1:56 PM: Found Adware: websearch toolbar
1:56 PM: HKLM\software\microsoft\windows\currentversion\installer\userdata\aui\ (1 subtraces) (ID = 146479)
1:56 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/winnt/downloaded program files/qdow.dll\ (2 subtraces) (ID = 146483)
1:56 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\winnt\downloaded program files\qdow.dll (ID = 146498)
1:56 PM: HKLM\system\currentcontrolset\enum\root\legacy_wintoolssvc\ (8 subtraces) (ID = 146518)
1:56 PM: HKLM\software\microsoft\windows nt\currentversion\winlogon\ || shell (ID = 711393)
1:56 PM: HKLM\software\microsoft\windows\currentversion\uninstall\bsto-1\ (7 subtraces) (ID = 746835)
1:56 PM: HKU\S-1-5-21-1275210071-1682526488-1343024091-500\software\microsoft\internet explorer\main\ || search bar (ID = 128206)
1:56 PM: HKU\S-1-5-21-1275210071-1682526488-1343024091-500\software\microsoft\internet explorer\main\ || search page (ID = 128207)
1:56 PM: HKU\S-1-5-21-1275210071-1682526488-1343024091-500\software\microsoft\internet explorer\searchurl\ (ID = 128212)
1:56 PM: Found Adware: kewlbar
1:56 PM: HKU\S-1-5-21-1275210071-1682526488-1343024091-500\software\microsoft\internet explorer\menuext\&kewlbar search\ (2 subtraces) (ID = 129544)
1:57 PM: HKU\S-1-5-21-1275210071-1682526488-1343024091-500\software\aurora\ (29 subtraces) (ID = 360174)
1:57 PM: Registry Sweep Complete, Elapsed Time:00:00:29
1:57 PM: Starting Cookie Sweep
1:57 PM: Found Spy Cookie: one-time-offer cookie
1:57 PM: administrator@one-time-offer[1].txt (ID = 3095)
1:57 PM: Found Spy Cookie: ask cookie
1:57 PM: administrator@ask[1].txt (ID = 2245)
1:57 PM: Found Spy Cookie: affiliate cookie
1:57 PM: administrator@affiliate[1].txt (ID = 2199)
1:57 PM: Found Spy Cookie: go.com cookie
1:57 PM: administrator@go[2].txt (ID = 2728)
1:57 PM: Found Spy Cookie: l2m.net cookie
1:57 PM: administrator@l2m[1].txt (ID = 2913)
1:57 PM: administrator@abc.abcnews.go[1].txt (ID = 2729)
1:57 PM: administrator@abcnews.go[2].txt (ID = 2729)
1:57 PM: Found Spy Cookie: classmates cookie
1:57 PM: administrator@classmates[2].txt (ID = 2384)
1:57 PM: Found Spy Cookie: informit cookie
1:57 PM: administrator@informit[1].txt (ID = 2863)
1:57 PM: Found Spy Cookie: 2o7.net cookie
1:57 PM: administrator@2o7[1].txt (ID = 1957)
1:57 PM: administrator@abc.go[1].txt (ID = 2729)
1:57 PM: Found Spy Cookie: homestore cookie
1:57 PM: administrator@homestore[1].txt (ID = 2793)
1:57 PM: administrator@houseandhome.aol.homestore[1].txt (ID = 2794)
1:57 PM: Found Spy Cookie: bannerspace cookie
1:57 PM: administrator@bannerspace[1].txt (ID = 2284)
1:57 PM: Found Spy Cookie: advertising cookie
1:57 PM: administrator@advertising[1].txt (ID = 2175)
1:57 PM: Found Spy Cookie: 247realmedia cookie
1:57 PM: administrator@247realmedia[1].txt (ID = 1953)
1:57 PM: Found Spy Cookie: linkexchange cookie
1:57 PM: administrator@linkexchange[1].txt (ID = 2920)
1:57 PM: administrator@disney.go[1].txt (ID = 2729)
1:57 PM: Found Spy Cookie: cliks cookie
1:57 PM: administrator@cliks[2].txt (ID = 2414)
1:57 PM: Found Spy Cookie: passion cookie
1:57 PM: administrator@passion[1].txt (ID = 3113)
1:57 PM: administrator@go[1].txt (ID = 2728)
1:57 PM: Found Spy Cookie: tickle cookie
1:57 PM: administrator@cookie.tickle[2].txt (ID = 3530)
1:57 PM: Found Spy Cookie: seeq cookie
1:57 PM: administrator@seeq[2].txt (ID = 3331)
1:57 PM: Found Spy Cookie: atwola cookie
1:57 PM: administrator@atwola[1].txt (ID = 2255)
1:57 PM: Found Spy Cookie: about cookie
1:57 PM: administrator@landscaping.about[1].txt (ID = 2038)
1:57 PM: Found Spy Cookie: mygeek cookie
1:57 PM: administrator@mygeek[1].txt (ID = 3041)
1:57 PM: Found Spy Cookie: reunion cookie
1:57 PM: administrator@reunion[1].txt (ID = 3255)
1:57 PM: Found Spy Cookie: webservicehosts cookie
1:57 PM: administrator@dr.webservicehosts[4].txt (ID = 3663)
1:57 PM: Found Spy Cookie: callwave cookie
1:57 PM: administrator@callwave[1].txt (ID = 2342)
1:57 PM: administrator@classmates[3].txt (ID = 2384)
1:57 PM: administrator@ask[5].txt (ID = 2245)
1:57 PM: administrator@homestore[2].txt (ID = 2793)
1:57 PM: administrator@infoseek.go[1].txt (ID = 2729)
1:57 PM: Found Spy Cookie: btgrab cookie
1:57 PM: administrator@btg.btgrab[2].txt (ID = 2333)
1:57 PM: administrator@abc.abcnews.go[3].txt (ID = 2729)
1:57 PM: administrator@bannerspace[2].txt (ID = 2284)
1:57 PM: Found Spy Cookie: tracking cookie
1:57 PM: administrator@tracking[2].txt (ID = 3571)
1:57 PM: Found Spy Cookie: dealtime cookie
1:57 PM: administrator@dealtime[2].txt (ID = 2505)
1:57 PM: Found Spy Cookie: overture cookie
1:57 PM: administrator@perf.overture[1].txt (ID = 3106)
1:57 PM: administrator@stat.dealtime[2].txt (ID = 2506)
1:57 PM: Found Spy Cookie: domain sponsor cookie
1:57 PM: administrator@search.domainsponsor[2].txt (ID = 2534)
1:57 PM: Found Spy Cookie: gotoast cookie
1:57 PM: administrator@gotoast[1].txt (ID = 2751)
1:57 PM: Found Spy Cookie: webtrendslive cookie
1:57 PM: administrator@statse.webtrendslive[1].txt (ID = 3667)
1:57 PM: Found Spy Cookie: belointeractive cookie
1:57 PM: administrator@ads.belointeractive[1].txt (ID = 2295)
1:57 PM: administrator@belointeractive[1].txt (ID = 2294)
1:57 PM: Found Spy Cookie: fastclick cookie
1:57 PM: administrator@media.fastclick[2].txt (ID = 2652)
1:57 PM: administrator@homestore[5].txt (ID = 2793)
1:57 PM: administrator@homestore[3].txt (ID = 2793)
1:57 PM: Found Spy Cookie: serving-sys cookie
1:57 PM: administrator@serving-sys[3].txt (ID = 3343)
1:57 PM: administrator@cookie.tickle[1].txt (ID = 3530)
1:57 PM: administrator@classmates[5].txt (ID = 2384)
1:57 PM: administrator@fastclick[1].txt (ID = 2651)
1:57 PM: Found Spy Cookie: offeroptimizer cookie
1:57 PM: administrator@offeroptimizer[2].txt (ID = 3087)
1:57 PM: Found Spy Cookie: apmebf cookie
1:57 PM: administrator@apmebf[2].txt (ID = 2229)
1:57 PM: Found Spy Cookie: videodome cookie
1:57 PM: administrator@videodome[2].txt (ID = 3638)
1:57 PM: Found Spy Cookie: rightmedia cookie
1:57 PM: administrator@rightmedia[1].txt (ID = 3259)
1:57 PM: administrator@windows.about[1].txt (ID = 2038)
1:57 PM: Found Spy Cookie: specificpop cookie
1:57 PM: administrator@specificpop[1].txt (ID = 3401)
1:57 PM: Found Spy Cookie: metareward.com cookie
1:57 PM: administrator@metareward[1].txt (ID = 2990)
1:57 PM: administrator@one-time-offer[2].txt (ID = 3095)
1:57 PM: administrator@28929374a.l2m[2].txt (ID = 2914)
1:57 PM: administrator@classmates[4].txt (ID = 2384)
1:57 PM: administrator@data1.perf.overture[1].txt (ID = 3106)
1:57 PM: administrator@abcnews.go[3].txt (ID = 2729)
1:57 PM: administrator@28929374a.l2m[1].txt (ID = 2914)
1:57 PM: administrator@go[3].txt (ID = 2728)
1:57 PM: administrator@dealtime[1].txt (ID = 2505)
1:57 PM: administrator@stat.dealtime[1].txt (ID = 2506)
1:57 PM: Found Spy Cookie: 216.221.138 cookie
1:57 PM: administrator@216.221.138[3].txt (ID = 1947)
1:57 PM: administrator@portfolios.abcnews.go[2].txt (ID = 2729)
1:57 PM: Found Spy Cookie: adlegend cookie
1:57 PM: administrator@adlegend[1].txt (ID = 2074)
1:57 PM: Found Spy Cookie: ping cookie
1:57 PM: administrator@ping[1].txt (ID = 3137)
1:57 PM: Found Spy Cookie: directtrack cookie
1:57 PM: administrator@lendinghope.directtrack[1].txt (ID = 2528)
1:57 PM: Found Spy Cookie: nextag cookie
1:57 PM: administrator@nextag[2].txt (ID = 5014)
1:57 PM: Found Spy Cookie: myaffiliateprogram.com cookie
1:57 PM: administrator@www.myaffiliateprogram[1].txt (ID = 3032)
1:57 PM: administrator@metareward[2].txt (ID = 2990)
1:57 PM: administrator@www.metareward[2].txt (ID = 2991)
1:57 PM: administrator@serving-sys[2].txt (ID = 3343)
1:57 PM: administrator@specificpop[2].txt (ID = 3401)
1:57 PM: Found Spy Cookie: did-it cookie
1:57 PM: administrator@did-it[2].txt (ID = 2523)
1:57 PM: Found Spy Cookie: azjmp cookie
1:57 PM: administrator@azjmp[1].txt (ID = 2270)
1:57 PM: administrator@homestore[4].txt (ID = 2793)
1:57 PM: administrator@www.ping[2].txt (ID = 3138)
1:57 PM: administrator@rsi.abcnews.go[1].txt (ID = 2729)
1:57 PM: administrator@gotoast[2].txt (ID = 2751)
1:57 PM: administrator@classmates[1].txt (ID = 2384)
1:57 PM: administrator@search.domainsponsor[1].txt (ID = 2534)
1:57 PM: administrator@www.myaffiliateprogram[2].txt (ID = 3032)
1:57 PM: Found Spy Cookie: adprofile cookie
1:57 PM: administrator@adprofile[1].txt (ID = 2084)
1:57 PM: Found Spy Cookie: ads.businessweek cookie
1:57 PM: administrator@ads.businessweek[2].txt (ID = 2113)
1:57 PM: administrator@about[2].txt (ID = 2037)
1:57 PM: administrator@directtrack[1].txt (ID = 2527)
1:57 PM: Found Spy Cookie: tacoda cookie
1:57 PM: administrator@tacoda[3].txt (ID = 6444)
1:57 PM: administrator@go[4].txt (ID = 2728)
1:57 PM: administrator@reunion[2].txt (ID = 3255)
1:57 PM: administrator@dealtime[3].txt (ID = 2505)
1:57 PM: Found Spy Cookie: qsrch cookie
1:57 PM: administrator@qsrch[3].txt (ID = 3215)
1:57 PM: administrator@abcnews.go[1].txt (ID = 2729)
1:57 PM: administrator@adprofile[3].txt (ID = 2084)
1:57 PM: administrator@about[4].txt (ID = 2037)
1:57 PM: administrator@nextag[1].txt (ID = 5014)
1:57 PM: administrator@stat.dealtime[4].txt (ID = 2506)
1:57 PM: Found Spy Cookie: primaryads cookie
1:57 PM: administrator@aff.primaryads[2].txt (ID = 3190)
1:57 PM: administrator@qsrch[1].txt (ID = 3215)
1:57 PM: administrator@ask[3].txt (ID = 2245)
1:57 PM: Found Spy Cookie: pub cookie
1:57 PM: administrator@pub[2].txt (ID = 3205)
1:57 PM: administrator@serving-sys[1].txt (ID = 3343)
1:57 PM: Found Spy Cookie: ic-live cookie
1:57 PM: administrator@ic-live[1].txt (ID = 2821)
1:57 PM: Found Spy Cookie: pokerroom cookie
1:57 PM: administrator@pokerroom[1].txt (ID = 3149)
1:57 PM: administrator@rapidresponse.directtrack[2].txt (ID = 2528)
1:57 PM: administrator@1.primaryads[1].txt (ID = 3190)
1:57 PM: Found Spy Cookie: burstnet cookie
1:57 PM: administrator@burstnet[2].txt (ID = 2336)
1:57 PM: administrator@tracking[3].txt (ID = 3571)
1:57 PM: administrator@azjmp[2].txt (ID = 2270)
1:57 PM: Found Spy Cookie: websponsors cookie
1:57 PM: administrator@a.websponsors[2].txt (ID = 3665)
1:57 PM: administrator@rightmedia[3].txt (ID = 3259)
1:57 PM: administrator@apmebf[3].txt (ID = 2229)
1:57 PM: Found Spy Cookie: banner cookie
1:57 PM: administrator@banner[1].txt (ID = 2276)
1:57 PM: administrator@belointeractive[2].txt (ID = 2294)
1:57 PM: administrator@ads.belointeractive[2].txt (ID = 2295)
1:57 PM: Found Spy Cookie: reliablestats cookie
1:57 PM: administrator@stats1.reliablestats[2].txt (ID = 3254)
1:57 PM: administrator@homestore[6].txt (ID = 2793)
1:57 PM: administrator@personalfinance.aol.homestore[2].txt (ID = 2794)
1:57 PM: administrator@homebuying.about[2].txt (ID = 2038)
1:57 PM: administrator@did-it[3].txt (ID = 2523)
1:57 PM: administrator@webservicehosts[2].txt (ID = 3662)
1:57 PM: Found Spy Cookie: specificclick.com cookie
1:57 PM: administrator@adopt.specificclick[1].txt (ID = 3400)
1:57 PM: administrator@classmates[7].txt (ID = 2384)
1:57 PM: administrator@ask[2].txt (ID = 2245)
1:57 PM: administrator@homestore[8].txt (ID = 2793)
1:57 PM: administrator@go[6].txt (ID = 2728)
1:57 PM: administrator@www.disney.go[1].txt (ID = 2729)
1:57 PM: administrator@dr.webservicehosts[2].txt (ID = 3663)
1:57 PM: Found Spy Cookie: screensavers.com cookie
1:57 PM: administrator@www.screensavers[2].txt (ID = 3298)
1:57 PM: administrator@i.screensavers[1].txt (ID = 3298)
1:57 PM: administrator@tacoda[2].txt (ID = 6444)
1:57 PM: administrator@psc.disney.go[1].txt (ID = 2729)
1:57 PM: administrator@classmates[6].txt (ID = 2384)
1:57 PM: administrator@belointeractive[4].txt (ID = 2294)
1:57 PM: administrator@mysa.belointeractive[1].txt (ID = 2295)
1:57 PM: administrator@ads.belointeractive[3].txt (ID = 2295)
1:57 PM: administrator@serving-sys[4].txt (ID = 3343)
1:57 PM: administrator@tracking[4].txt (ID = 3571)
1:57 PM: administrator@apmebf[1].txt (ID = 2229)
1:57 PM: administrator@did-it[1].txt (ID = 2523)
1:57 PM: Found Spy Cookie: hypertracker.com cookie
1:57 PM: administrator@hypertracker[2].txt (ID = 2817)
1:57 PM: administrator@disneyworld.disney.go[1].txt (ID = 2729)
1:57 PM: administrator@secure.disney.go[1].txt (ID = 2729)
1:57 PM: Found Spy Cookie: burstbeacon cookie
1:57 PM: administrator@www.burstbeacon[1].txt (ID = 2335)
1:57 PM: administrator@ask[4].txt (ID = 2245)
1:57 PM: administrator@lists.classmates[1].txt (ID = 2385)
1:57 PM: administrator@about[3].txt (ID = 2037)
1:57 PM: administrator@www.homestore[2].txt (ID = 2794)
1:57 PM: administrator@disney.go[2].txt (ID = 2729)
1:57 PM: administrator@burstnet[3].txt (ID = 2336)
1:57 PM: Found Spy Cookie: military cookie
1:57 PM: administrator@military[1].txt (ID = 2996)
1:57 PM: Found Spy Cookie: pch cookie
1:57 PM: administrator@sb.pch[1].txt (ID = 3124)
1:57 PM: administrator@dr.webservicehosts[3].txt (ID = 3663)
1:57 PM: Found Spy Cookie: trb.com cookie
1:57 PM: administrator@trb[2].txt (ID = 3587)
1:57 PM: administrator@did-it[4].txt (ID = 2523)
1:57 PM: administrator@go[5].txt (ID = 2728)
1:57 PM: Found Spy Cookie: clicktracks cookie
1:57 PM: administrator@stats2.clicktracks[2].txt (ID = 2407)
1:57 PM: administrator@rsi.espn.go[1].txt (ID = 2729)
1:57 PM: administrator@espn.go[1].txt (ID = 2729)
1:57 PM: administrator@sports.espn.go[2].txt (ID = 2729)
1:57 PM: administrator@tacoda[1].txt (ID = 6444)
1:57 PM: administrator@ads.belointeractive[4].txt (ID = 2295)
1:57 PM: administrator@belointeractive[5].txt (ID = 2294)
1:57 PM: administrator@homestore[9].txt (ID = 2793)
1:57 PM: administrator@classmates[9].txt (ID = 2384)
1:57 PM: Found Spy Cookie: yieldmanager cookie
1:57 PM: administrator@yieldmanager[1].txt (ID = 3749)
1:57 PM: administrator@apmebf[5].txt (ID = 2229)
1:57 PM: administrator@serving-sys[5].txt (ID = 3343)
1:57 PM: administrator@a.websponsors[3].txt (ID = 3665)
1:57 PM: administrator@adopt.specificclick[3].txt (ID = 3400)
1:57 PM: Cookie Sweep Complete, Elapsed Time: 00:00:09
1:57 PM: Starting File Sweep
1:57 PM: Warning: Failed to open file "c:\pagefile.sys". Access is denied
2:09 PM: Found Adware: twain-tech
2:09 PM: polmx2.exe (ID = 81899)
2:09 PM: Found Adware: dialerplatform
2:09 PM: sportsinteraction.ico (ID = 58328)
2:09 PM: awjyqic.exe (ID = 280398)
2:09 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || wdjjqh (ID = 0)
2:18 PM: Found Adware: dealhelper
2:18 PM: hookpopup.dll (ID = 57618)
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\software.log". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\default.log". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\security". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\security.log". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\system.alt". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\sam". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\sam.log". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\system". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\software". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to open file "c:\winnt\system32\config\default". The process cannot access the file because it is being used by another process
2:21 PM: c:\winnt\system32\dealhelper (ID = -2147481148)
2:21 PM: Found Trojan Horse: 2nd-thought
2:21 PM: c:\winnt\system32\newmsrdk (ID = -2147481534)
2:21 PM: belt.inf (ID = 83154)
2:21 PM: biini.inf (ID = 83199)
2:21 PM: polmx2.inf (ID = 83430)
2:22 PM: Found Adware: whenu
2:22 PM: wuinst.inf (ID = 74480)
2:22 PM: lotto.inf (ID = 83371)
2:22 PM: Found Adware: exact cashback/bargain buddy
2:22 PM: installer_marketing11.exe (ID = 50674)
2:22 PM: installer_vendare4.exe (ID = 50712)
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsb0114567-2efb-44a1-bc0e-224d34b36cad.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs043a1668-6215-4d32-9c6f-dd78cb9fe47d.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsa8489144-c151-40fd-a07d-b07589c40ef2.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsccc5ba1b-09ce-4094-8f04-422fc55b16d6.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs9f569d37-1eb5-4786-93e9-570a79af5a36.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs24f21980-f49e-4604-b980-f5b5d5f6b950.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs8ab2db0d-7f49-4d24-8ec1-13fec70395b0.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsd0c355fe-b7ee-4c6f-9662-9c365afb9913.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsdc4977ce-fbac-432f-a246-c98fe8f737b6.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs0777b887-4f05-4795-82b4-ce61298a2627.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsdaa9e48e-c5d7-4294-930b-81095ef33f42.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsceb9a6f4-e780-47f8-8f73-30b0228b2b66.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscse39acc33-0143-42a2-a537-6c435473cee6.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs4671c79b-114b-4261-8816-5f1abfccdc09.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs211417ff-df6b-4c43-a643-3ed3f3fd2327.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs947c7a6e-daf8-46cd-9cc6-215f5ad82cec.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs05cc0c91-13ed-4b40-b1c4-85f10a7fb60d.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscse6fe4a23-287e-4f1d-adf7-f3fd966c63b3.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs660541f6-af95-44e3-89ea-501debae9fda.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs232f6cc0-40f9-4342-a426-8ae79a144304.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs7d28d8a1-a260-4ca6-98ee-f2a0561528c6.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs9fa198b9-326b-4a23-b57e-eb381fc98393.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs8e54e1a6-29a3-415b-9e84-8f06436fa2da.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs68d9d6e2-9794-4ab8-90bd-6b7145ab734d.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs2d42d10c-b212-48f6-8b9f-0aa8c104fa44.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsadc44a70-c84c-4b15-a4e1-9d1f0ab51994.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsc39e97b2-5ea6-4b4b-9716-35affc463133.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsc71bec5f-11d0-464b-a3f3-cf53c8bd8713.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsc61848e7-6495-4161-b8a1-a1a697bc76d7.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs02583f17-c2b0-439a-8e06-9798e432cbe4.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs735abc14-4c0b-47fe-985b-9ecf2f7e0a36.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs6ba1a6dc-3480-4f75-94e1-612359e2b6fd.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs0c45805d-4033-46c5-bf1b-f157a9c7ea2d.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsa1662a09-3990-4938-a97c-55dadb0d2dc2.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs77789cd5-6680-43af-b555-6383fe64da32.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsf69847ca-7bf2-461b-8188-534fcf142323.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsdb37314a-5693-4138-8616-f2f7a8a547bf.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsb503b5d2-b217-4a35-aa62-63f1e4736743.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsc183f475-849c-44c5-88dd-e5d10e2bf60f.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsaaf03f5f-81ff-4e59-8d06-425a6498c43e.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs82ba52c4-49ff-494d-afc9-a57f3bb07388.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsa6a458f1-cad6-473e-b59b-1c9239be493a.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs850fa26a-00e4-42c3-a01f-8d5ab13dac36.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsf885c493-338f-4687-8a96-35fbbf410ae8.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsa39a3e2e-71ef-4c4e-bdba-31fba9e6254c.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs70649cb1-7f6b-4dd8-8dbc-6a85f9ba1a98.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs88a03f4d-7251-44cf-8367-6334b11d675d.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs165e3837-adbf-4c7e-80d1-3cff057e890c.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs8374fbe9-740b-4b2b-bccb-ebd115b7199b.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs94362472-a212-4db7-b453-d8adcbdb25d5.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs33aae504-5cc6-4c25-a700-965fd2192607.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs82dcfeea-7313-44b2-bcbd-ae50406e4676.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs03a92487-75b5-4a48-9313-ffaf23c2cf80.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsb1e488be-5f5d-4495-a6bd-3a47bb66eb58.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsd5715908-0540-4863-9f49-4bc9faf475a4.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs0787e3e9-5b01-407a-9d62-ca0d971d9a2e.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs6f895b31-b22e-4c14-ab7b-c44e4f3371bd.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs249446ec-d018-47d1-9b38-96d9dfec421e.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs07694672-669c-4dcf-abe2-8025d5d5e21e.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs8fb9e4e0-4adf-4e7e-8047-137e857be2bc.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscscb51b8ba-2adc-4bf6-8a03-728618653506.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs27cb8b2a-ada7-40e1-951b-355ef435a8aa.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs3a6007d1-3df4-43f8-992e-d22f1a94f868.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsddf11dc8-aa30-4b61-a1c2-b422f41affc2.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsb55aeaa9-477c-4c32-8245-ac5e63fbc8fd.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs95f66be0-53fa-4b8e-8cc8-e4bd93ea65f9.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs553b8be5-4532-4c6b-9511-c2c4e34d36ab.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs1129e77f-90c9-4a81-b3c3-794570f0b35d.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs0f060061-14ab-47b7-a777-0ce6609c0046.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs917fb8e9-f3fd-4be5-8c5f-80cc0611e935.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs24084929-50c3-4c27-8bfd-6dff3376a4e2.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs07fb3de7-20f3-4274-b130-c1605fda3894.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs48814cc4-2978-43af-aade-afa1f646dcc8.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs036a8b5b-eccb-4625-8469-0be632d3c776.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs90aa4a96-9071-42a9-9b6a-4c86d4800a21.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsf9aa9ee9-09d6-40b8-91c9-cafdf3bd1563.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs39656930-d4ef-4c33-9d2e-1bb2c6aa9994.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs24c13558-3886-419e-ab86-9165a5a324ee.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsb16898be-dc39-4cb1-8dac-49ecf173a545.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsbc5102cd-b934-4045-ad25-d99147740077.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs5c2e9301-5336-48b1-ba12-d5d6df9f45c7.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs4122f618-6b1e-43e3-ad5c-541416319d70.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs6b1ae3e8-ed2e-4402-b95e-9c47b97ad63c.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs455ec1b9-ece3-45ac-888c-7eab29fcc7e4.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsf1926ede-54a8-4868-9e01-491b65595728.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs5c29b566-8af0-46bb-a35b-d8c5573e5647.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs0cb3c9b0-dd5a-4534-8e75-f7f6f4464347.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs7cc35dc1-a9c3-496d-8df3-1f0b4d6f317a.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsbc896901-4cbc-4a24-a610-1f7e47fabff1.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs3d19ea7c-f4e5-4942-81a5-0afc9fab5633.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs46dcad9e-e501-498c-8a71-dcfcdf2313f6.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs215ff40a-c314-45bd-ba74-b87b68464702.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsae70e3d4-4321-4a79-8015-368592a864ba.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs1dc7dc4d-98b2-402b-983d-43bfe29805ac.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs2449bb4a-b019-431e-a181-51fae946abad.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsce697c5c-96dd-404e-b938-92895a953e31.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsf553fe84-5a9b-4e00-b8a5-76d2fc0427be.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs3f032625-df3c-47ec-8398-8eb891bf3953.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs8786922c-46bd-4494-8d99-d513d021fbfd.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs6b79f49a-6056-4fcb-ae1b-a3f4e5bd6732.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs79442214-8632-431a-96eb-3e46682caa54.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscs1e0690ba-6b15-48ad-8a93-2c6f8309f285.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsdb4a874e-f61d-4577-a8e7-81f1bf5e779a.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\all users\application data\webroot\spy sweeper\temp\sscsff99ea65-df6d-43a6-8573-406eeb3fd5f5.tmp". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\administrator\ntuser.dat". The process cannot access the file because it is being used by another process
2:27 PM: Warning: Failed to open file "c:\documents and settings\administrator\ntuser.dat.log". The process cannot access the file because it is being used by another process
2:31 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
2:31 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
2:31 PM: updall2m[1].exe (ID = 83632)
2:31 PM: belt.inf (ID = 83154)
2:31 PM: belt.ini (ID = 83156)
2:32 PM: ~309820.tmp (ID = 87004)
2:32 PM: ~332807.tmp (ID = 87004)
2:32 PM: ~343159.tmp (ID = 87004)
2:32 PM: ~338122.tmp (ID = 87004)
2:32 PM: ~342257.tmp (ID = 87004)
2:32 PM: ~664693.tmp (ID = 87004)
2:32 PM: ~328589.tmp (ID = 87004)
2:32 PM: ~309812.tmp (ID = 87004)
2:32 PM: ~341286.tmp (ID = 87004)
2:32 PM: ~398466.tmp (ID = 87004)
2:32 PM: ~302842.tmp (ID = 87004)
2:32 PM: ~805588.tmp (ID = 87004)
2:32 PM: ~311579.tmp (ID = 87004)
2:32 PM: polmx2

[howgain]

Spy Sweeper Log continued:

2:32 PM: polmx2.exe (ID = 81899)
2:32 PM: Found Adware: 180search assistant/zango
2:32 PM: 180sainstallersilsais1.exe (ID = 107349)
2:32 PM: res6c.tmp (ID = 107353)
2:32 PM: dealhelper.exe (ID = 57574)
2:32 PM: Found Adware: ist surf accuracy
2:32 PM: uninstall.exe (ID = 131729)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: Found Adware: gsim
2:32 PM: gsim.cab (ID = 61965)
2:32 PM: gsim.inf (ID = 61964)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:32 PM: conflict.cab (ID = 84685)
2:32 PM: conflict.inf (ID = 84686)
2:33 PM: Found Adware: winantispyware 2005
2:33 PM: setup.exe (ID = 122245)
2:33 PM: installer_vendare4.exe (ID = 50712)
2:41 PM: toolbar.dll (ID = 65042)
2:41 PM: basis.xml (ID = 65028)
2:41 PM: basis.key (ID = 65027)
2:41 PM: version.txt (ID = 65047)
2:41 PM: icons.bmp (ID = 65030)
2:41 PM: tb_commands.xml (ID = 65039)
2:41 PM: options.html (ID = 65035)
2:41 PM: favicon.ico (ID = 65029)
2:41 PM: logo.bmp (ID = 65034)
2:41 PM: toolbar.inf (ID = 65045)
2:41 PM: inst.bat (ID = 65031)
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: Warning: Unhandled Archive Type
2:43 PM: File Sweep Complete, Elapsed Time: 00:46:28
2:43 PM: Full Sweep has completed. Elapsed time 00:56:27
2:43 PM: Traces Found: 356
3:02 PM: | End of Session, Tuesday, April 18, 2006 |
********
4:12 PM: Preparing to restart your computer. Please wait...
4:12 PM: Removal process completed. Elapsed time 00:02:11

[LDTate]

Click HERE and download the Istsvc fix
http://securityrespo...er/FxIstbar.exe
Run the fix.


Did you add this site to your trusted Zones? If not, add to the HijackThis fix
O15 - Trusted Zone: http://vsp.closetmaid.com

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [*iptapi] C:\WINNT\system32\NPP\iptapi.exe
O4 - HKLM\..\Run: [*srvbak] C:\WINNT\Config\srvbak.exe
O4 - HKLM\..\Run: [*libvb] C:\WINNT\repair\libvb.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [kOIRqdDR] C:\WINNT\ootftcwp.exe
O4 - HKLM\..\Run: [ùõ€-‚²‘ÆßÎ7bñº@õ‰C:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\ootftcwp.exe

O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab

O16 - DPF: {666DDE35-E955-11D0-A707-000000521958} - http://69.56.176.227/webplugin.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.co...aploader_v7.cab

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete these Files if listed:
C:\WINNT\system32\NPP\iptapi.exe
C:\WINNT\Config\srvbak.exe
C:\WINNT\repair\libvb.exe
C:\WINNT\ootftcwp.exe
C:\Program Files\ISTsvc\istsvc.exe


Open C:\Windows\Prefetch\ Delete ALL files in this folder.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

[howgain]

LDTate,

Thanks so much for helping me. With each successive fix the computer seems to get faster and more responsive.

The Istbar fix did not find Istbar on the computer. I'm not sure why. I could not find the C:\Windows\Prefetch folder.

The new Hijack This Log is posted below.


Logfile of HijackThis v1.99.1
Scan saved at 6:32:45 PM, on 4/18/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe
C:\PROGRA~1\IBM\CLIENT~1\cwbbs.exe
C:\PROGRA~1\IBM\CLIENT~1\cwbntred.exe
C:\WINNT\Explorer.EXE
C:\Program Files\IBM\Client Access\CWBPROVD.EXE
C:\Program Files\IBM\Client Access\CWBSVD.EXE
C:\Program Files\IBM\Client Access\cwbuitsk.exe
C:\PROGRA~1\NavNT\vptray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
F2 - REG:system.ini: UserInit=C:\PROGRA~1\IBM\CLIENT~1\cwbbs.exe,C:\PROGRA~1\IBM\CLIENT~1\cwbntred.exe,C:\PROGRA~1\IBM\CLIENT~1\cwbprovd.exe,C:\WINNT\system32\userinit.exe,
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [madexe] C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\mad.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\CwbSvStr.Exe"
O4 - HKLM\..\Run: [Client Access Taskbar] "C:\Program Files\IBM\Client Access\cwbuitsk.exe"
O4 - HKLM\..\Run: [Client Access API Daemon] "C:\Program Files\IBM\Client Access\cwbappcd.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: Canasta by pogo - http://game1.pogo.co...nasta-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.co...peaks-en_US.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.co...rols/Rovion.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://aolsvc.aol.co...bugs/axhost.cab
O16 - DPF: {8B6193F1-837F-11D4-89E6-0050DA666184} (Sol2axctl Class) - http://download.soli...d/solitaire.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...0/Installer.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7698745-A628-424F-961C-81E08575E312}: NameServer = 192.168.1.1
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Client Access Remote Command (Cwbrxd) - IBM Corporation - C:\WINNT\CWBRXD.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)

[LDTate]

I could not find the C:\Windows\Prefetch folder.

Sorry about that, that's for XP.

Run HijackThis and fix these:

O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab

O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...0/Installer.exe

Log looks pretty good. How/s it running?

[howgain]

I could not find the C:\Windows\Prefetch folder.

Sorry about that, that's for XP.

Run HijackThis and fix these:

O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab

O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...0/Installer.exe

Log looks pretty good. How/s it running?

It is running much, much better. Thank you!!!! I'm not sure how my in-laws picked up so much garbage, but I guess it's not hard to do.

[LDTate]

Good Job

Log looks good


1.Do one of the following:
In Windows 98/Me/2000, on the Windows desktop, double-click the My Computer icon.
In Windows XP, on the taskbar, click Start > My Computer.

2.Do one of the following:
In Windows 98, on the View menu, click Folder Options.
In Windows Me/2000/XP, on the Tools menu, click Folder Options.
On the View tab, check Hide file extensions for known file types.

3.Do one of the following:
In Windows 98, in the Advanced Settings box, under the "Hidden files" folder, unclick Show all files.
In Windows Me/2000/XP, check Hide protected operating system files. Then, under the "Hidden files" folder, unclick Show hidden files and folders.
If you see a warning message, click Yes.
Click Apply.
Click OK.



If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

[howgain]

Everything's running smooth now. Thanks again.

[LDTate]

Great job You're more then welcome. Glad we were able to help Peace be with you

[LDTate]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php