thanks so much! spy sweeper found the virus, trojan-downloader-conhook, plus a lot of spyware that my other programs didn't catch. the only weird thing is that while it was fixing the problems, it suddnely turned off and restarted. i am not sure if that is nomral or not. the computer seems to be running at normal speed again, and norton isnt bothering me about the virus anymore so im assuming its gone. here is the log, as well as the new hj log:
********
7:37 PM: | Start of Session, Sunday, April 16, 2006 |
7:37 PM: Spy Sweeper started
7:37 PM: Sweep initiated using definitions version 658
7:37 PM: Found Adware: virtumonde
7:37 PM: HKCR\clsid\{2353fcbc-012d-487b-8bf3-865c0929fbeb}\inprocserver32\ (2 subtraces) (ID = 1142174)
7:37 PM: rqolm.dll (ID = 1142174)
7:37 PM: Found Trojan Horse: trojan-downloader-conhook
7:37 PM: HKCR\clsid\{adcd30ff-0119-4906-8a8b-d52d1eed044b}\inprocserver32\ (2 subtraces) (ID = 1223972)
7:37 PM: byxwv.dll (ID = 1223972)
7:37 PM: Starting Memory Sweep
7:37 PM: Detected running threat: C:\WINDOWS\system32\byxwv.dll (ID = 274080)
7:38 PM: Detected running threat: C:\WINDOWS\system32\rqolm.dll (ID = 77)
7:41 PM: Memory Sweep Complete, Elapsed Time: 00:03:52
7:41 PM: Starting Registry Sweep
7:41 PM: Found Adware: blazefind
7:41 PM: HKLM\software\classes\winctladx.installer\ (3 subtraces) (ID = 104503)
7:41 PM: HKCR\winctladx.installer\ (3 subtraces) (ID = 104569)
7:41 PM: Found Adware: ieplugin
7:41 PM: HKLM\software\classes\typelib\{074a9743-0517-454c-b2f4-ff964de43e4c}\ (9 subtraces) (ID = 128168)
7:41 PM: HKCR\typelib\{074a9743-0517-454c-b2f4-ff964de43e4c}\ (9 subtraces) (ID = 128200)
7:41 PM: Found Adware: syncroad
7:41 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\syncroadx.dll (ID = 143515)
7:41 PM: HKCR\atldistrib.atldistrib\ (5 subtraces) (ID = 1030533)
7:41 PM: HKCR\atldistrib.atldistrib\clsid\ (1 subtraces) (ID = 1030535)
7:41 PM: HKCR\atldistrib.atldistrib\curver\ (1 subtraces) (ID = 1030537)
7:41 PM: HKCR\atldistrib.atldistrib.1\ (3 subtraces) (ID = 1030539)
7:41 PM: HKCR\atldistrib.atldistrib.1\clsid\ (1 subtraces) (ID = 1030541)
7:41 PM: HKLM\software\classes\atldistrib.atldistrib\ (5 subtraces) (ID = 1030666)
7:41 PM: HKLM\software\classes\atldistrib.atldistrib\clsid\ (1 subtraces) (ID = 1030668)
7:41 PM: HKLM\software\classes\atldistrib.atldistrib\curver\ (1 subtraces) (ID = 1030670)
7:41 PM: HKLM\software\classes\atldistrib.atldistrib.1\ (3 subtraces) (ID = 1030672)
7:41 PM: HKLM\software\classes\atldistrib.atldistrib.1\clsid\ (1 subtraces) (ID = 1030674)
7:41 PM: HKCR\clsid\{2353fcbc-012d-487b-8bf3-865c0929fbeb}\ (12 subtraces) (ID = 1124723)
7:41 PM: HKLM\software\classes\clsid\{2353fcbc-012d-487b-8bf3-865c0929fbeb}\ (12 subtraces) (ID = 1124736)
7:41 PM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{2353fcbc-012d-487b-8bf3-865c0929fbeb}\ (ID = 1124749)
7:41 PM: HKCR\clsid\{adcd30ff-0119-4906-8a8b-d52d1eed044b}\ (3 subtraces) (ID = 1223957)
7:41 PM: HKLM\software\classes\clsid\{adcd30ff-0119-4906-8a8b-d52d1eed044b}\ (3 subtraces) (ID = 1223961)
7:41 PM: HKLM\software\microsoft\windows\currentversion\explorer\shellexecutehooks\ || {adcd30ff-0119-4906-8a8b-d52d1eed044b} (ID = 1223965)
7:41 PM: Found Adware: ebates money maker
7:41 PM: HKU\S-1-5-21-4268582733-1274370631-3825234021-1006\software\microsoft\internet explorer\extensions\cmdmapping\ || {6685509e-b47b-4f47-8e16-9a5f3a62f683} (ID = 125587)
7:41 PM: HKU\S-1-5-21-4268582733-1274370631-3825234021-1006\software\enhsrch\ (124 subtraces) (ID = 128172)
7:41 PM: Found Adware: drsnsrch hijacker
7:41 PM: HKU\S-1-5-21-4268582733-1274370631-3825234021-1006\software\dsrch\ (11 subtraces) (ID = 509156)
7:41 PM: Found Adware: powwa bar
7:41 PM: HKU\S-1-5-21-4268582733-1274370631-3825234021-1006\software\microsoft\internet explorer\toolbar\webbrowser\ || {4e7bd74f-2b8d-469e-c0ff-fd6da382b52d} (ID = 510639)
7:41 PM: Registry Sweep Complete, Elapsed Time:00:00:11
7:41 PM: Starting Cookie Sweep
7:41 PM: Found Spy Cookie: primaryads cookie
7:41 PM: karin curtis@1.primaryads[1].txt (ID = 3190)
7:41 PM: Found Spy Cookie: 2o7.net cookie
7:41 PM: karin curtis@112.2o7[2].txt (ID = 1958)
7:41 PM: Found Spy Cookie: 247realmedia cookie
7:41 PM: karin curtis@247realmedia[1].txt (ID = 1953)
7:41 PM: karin curtis@2o7[1].txt (ID = 1957)
7:41 PM: Found Spy Cookie: 498 cookie
7:41 PM: karin curtis@498[1].txt (ID = 1975)
7:41 PM: Found Spy Cookie: 5 cookie
7:41 PM: karin curtis@5[1].txt (ID = 1979)
7:41 PM: Found Spy Cookie: 64.62.232 cookie
7:41 PM: karin curtis@64.62.232[1].txt (ID = 1987)
7:41 PM: karin curtis@64.62.232[2].txt (ID = 1987)
7:41 PM: Found Spy Cookie: 888 cookie
7:41 PM: karin curtis@888[1].txt (ID = 2019)
7:41 PM: karin curtis@888[2].txt (ID = 2019)
7:41 PM: Found Spy Cookie: websponsors cookie
7:41 PM: karin curtis@a.websponsors[1].txt (ID = 3665)
7:41 PM: Found Spy Cookie: aa cookie
7:41 PM: karin curtis@aa[1].txt (ID = 2029)
7:41 PM: Found Spy Cookie: go.com cookie
7:41 PM: karin curtis@abc.go[2].txt (ID = 2729)
7:41 PM: karin curtis@abcnews.go[1].txt (ID = 2729)
7:41 PM: Found Spy Cookie: abetterinternet cookie
7:41 PM: karin curtis@abetterinternet[1].txt (ID = 2035)
7:41 PM: Found Spy Cookie: about cookie
7:41 PM: karin curtis@about[1].txt (ID = 2037)
7:41 PM: Found Spy Cookie: accoona cookie
7:41 PM: karin curtis@accoona[2].txt (ID = 2041)
7:41 PM: Found Spy Cookie: yieldmanager cookie
7:41 PM: karin curtis@ad.yieldmanager[2].txt (ID = 3751)
7:41 PM: karin curtis@add.about[2].txt (ID = 2038)
7:41 PM: Found Spy Cookie: adecn cookie
7:41 PM: karin curtis@adecn[2].txt (ID = 2063)
7:41 PM: Found Spy Cookie: adknowledge cookie
7:41 PM: karin curtis@adknowledge[2].txt (ID = 2072)
7:41 PM: Found Spy Cookie: adlegend cookie
7:41 PM: karin curtis@adlegend[2].txt (ID = 2074)
7:41 PM: Found Spy Cookie: hbmediapro cookie
7:41 PM: karin curtis@adopt.hbmediapro[2].txt (ID = 2768)
7:41 PM: Found Spy Cookie: precisead cookie
7:41 PM: karin curtis@adopt.precisead[2].txt (ID = 3182)
7:41 PM: Found Spy Cookie: specificclick.com cookie
7:41 PM: karin curtis@adopt.specificclick[2].txt (ID = 3400)
7:41 PM: Found Spy Cookie: adprofile cookie
7:41 PM: karin curtis@adprofile[1].txt (ID = 2084)
7:41 PM: Found Spy Cookie: adrevolver cookie
7:41 PM: karin curtis@adrevolver[1].txt (ID = 2088)
7:41 PM: karin curtis@adrevolver[2].txt (ID = 2088)
7:41 PM: Found Spy Cookie: addynamix cookie
7:41 PM: karin curtis@ads.addynamix[1].txt (ID = 2062)
7:41 PM: Found Spy Cookie: cc214142 cookie
7:41 PM: karin curtis@ads.cc214142[1].txt (ID = 2367)
7:41 PM: Found Spy Cookie: euniverseads cookie
7:41 PM: karin curtis@ads.euniverseads[1].txt (ID = 2630)
7:41 PM: Found Spy Cookie: pointroll cookie
7:41 PM: karin curtis@ads.pointroll[2].txt (ID = 3148)
7:41 PM: Found Spy Cookie: bpath cookie
7:41 PM: karin curtis@ads18.bpath[1].txt (ID = 2321)
7:41 PM: Found Spy Cookie: adtech cookie
7:41 PM: karin curtis@adtech[2].txt (ID = 2155)
7:41 PM: Found Spy Cookie: adultfriendfinder cookie
7:41 PM: karin curtis@adultfriendfinder[1].txt (ID = 2165)
7:41 PM: Found Spy Cookie: advertising cookie
7:41 PM: karin curtis@advertising[2].txt (ID = 2175)
7:41 PM: Found Spy Cookie: affiliate cookie
7:41 PM: karin curtis@affiliate[1].txt (ID = 2199)
7:41 PM: karin curtis@alcoholism.about[1].txt (ID = 2038)
7:41 PM: Found Spy Cookie: alt cookie
7:41 PM: karin curtis@alt[2].txt (ID = 2217)
7:41 PM: Found Spy Cookie: tacoda cookie
7:41 PM: karin curtis@anat.tacoda[1].txt (ID = 6445)
7:41 PM: Found Spy Cookie: apmebf cookie
7:41 PM: karin curtis@apmebf[1].txt (ID = 2229)
7:41 PM: karin curtis@app.abc.go[1].txt (ID = 2729)
7:41 PM: Found Spy Cookie: atwola cookie
7:41 PM: karin curtis@ar.atwola[1].txt (ID = 2256)
7:41 PM: Found Spy Cookie: falkag cookie
7:41 PM: karin curtis@as-us.falkag[1].txt (ID = 2650)
7:41 PM: Found Spy Cookie: casalemedia cookie
7:41 PM: karin curtis@as.casalemedia[1].txt (ID = 2355)
7:41 PM: Found Spy Cookie: askmen cookie
7:41 PM: karin curtis@askmen[2].txt (ID = 2247)
7:41 PM: Found Spy Cookie: ask cookie
7:41 PM: karin curtis@ask[2].txt (ID = 2245)
7:41 PM: Found Spy Cookie: atlas dmt cookie
7:41 PM: karin curtis@atdmt[2].txt (ID = 2253)
7:41 PM: Found Spy Cookie: belnk cookie
7:41 PM: karin curtis@ath.belnk[1].txt (ID = 2293)
7:41 PM: karin curtis@atheism.about[1].txt (ID = 2038)
7:41 PM: karin curtis@atwola[1].txt (ID = 2255)
7:41 PM: karin curtis@autorepair.about[2].txt (ID = 2038)
7:41 PM: Found Spy Cookie: azjmp cookie
7:41 PM: karin curtis@azjmp[2].txt (ID = 2270)
7:41 PM: Found Spy Cookie: a cookie
7:41 PM: karin curtis@a[1].txt (ID = 2027)
7:41 PM: karin curtis@a[2].txt (ID = 2027)
7:41 PM: karin curtis@a[3].txt (ID = 2027)
7:41 PM: karin curtis@a[4].txt (ID = 2027)
7:41 PM: Found Spy Cookie: inet-traffic.com cookie
7:41 PM: karin curtis@banner3.inet-traffic[1].txt (ID = 2856)
7:41 PM: Found Spy Cookie: banner cookie
7:41 PM: karin curtis@banner[2].txt (ID = 2276)
7:41 PM: karin curtis@beauty.about[2].txt (ID = 2038)
7:41 PM: karin curtis@belnk[1].txt (ID = 2292)
7:41 PM: Found Spy Cookie: bizrate cookie
7:41 PM: karin curtis@bizrate[2].txt (ID = 2308)
7:41 PM: Found Spy Cookie: bluestreak cookie
7:41 PM: karin curtis@bluestreak[1].txt (ID = 2314)
7:41 PM: karin curtis@bookspan.122.2o7[1].txt (ID = 1958)
7:41 PM: Found Spy Cookie: bravenet cookie
7:41 PM: karin curtis@bravenet[1].txt (ID = 2322)
7:41 PM: Found Spy Cookie: bs.serving-sys cookie
7:41 PM: karin curtis@bs.serving-sys[1].txt (ID = 2330)
7:41 PM: Found Spy Cookie: btgrab cookie
7:41 PM: karin curtis@btg.btgrab[2].txt (ID = 2333)
7:41 PM: Found Spy Cookie: burstnet cookie
7:41 PM: karin curtis@burstnet[2].txt (ID = 2336)
7:41 PM: karin curtis@buycom.122.2o7[1].txt (ID = 1958)
7:41 PM: Found Spy Cookie: enhance cookie
7:41 PM: karin curtis@c.enhance[2].txt (ID = 2614)
7:41 PM: Found Spy Cookie: barelylegal cookie
7:41 PM: karin curtis@c.fsx[1].txt (ID = 2286)
7:41 PM: Found Spy Cookie: zedo cookie
7:41 PM: karin curtis@c5.zedo[1].txt (ID = 3763)
7:41 PM: Found Spy Cookie: callwave cookie
7:41 PM: karin curtis@callwave[2].txt (ID = 2342)
7:41 PM: karin curtis@casalemedia[1].txt (ID = 2354)
7:41 PM: Found Spy Cookie: cassava cookie
7:41 PM: karin curtis@cassava[1].txt (ID = 2362)
7:41 PM: karin curtis@cats.about[2].txt (ID = 2038)
7:41 PM: Found Spy Cookie: adbureau cookie
7:41 PM: karin curtis@cent.adbureau[1].txt (ID = 2060)
7:41 PM: karin curtis@chicagosuntimes.122.2o7[1].txt (ID = 1958)
7:41 PM: karin curtis@classicrock.about[2].txt (ID = 2038)
7:41 PM: Found Spy Cookie: classmates cookie
7:41 PM: karin curtis@classmates[2].txt (ID = 2384)
7:41 PM: Found Spy Cookie: clickbank cookie
7:41 PM: karin curtis@clickbank[1].txt (ID = 2398)
7:41 PM: Found Spy Cookie: cliks cookie
7:41 PM: karin curtis@cliks[1].txt (ID = 2414)
7:41 PM: karin curtis@cnn.122.2o7[1].txt (ID = 1958)
7:41 PM: Found Spy Cookie: tickle cookie
7:41 PM: karin curtis@cookie.tickle[1].txt (ID = 3530)
7:41 PM: karin curtis@coxhsi.112.2o7[1].txt (ID = 1958)
7:41 PM: karin curtis@cratebarrel.112.2o7[1].txt (ID = 1958)
7:41 PM: Found Spy Cookie: 360i cookie
7:41 PM: karin curtis@ct.360i[1].txt (ID = 1962)
7:41 PM: Found Spy Cookie: customer cookie
7:41 PM: karin curtis@customer[1].txt (ID = 2481)
7:41 PM: karin curtis@customer[2].txt (ID = 2481)
7:41 PM: karin curtis@customer[3].txt (ID = 2481)
7:41 PM: karin curtis@customer[4].txt (ID = 2481)
7:41 PM: karin curtis@customer[5].txt (ID = 2481)
7:41 PM: karin curtis@customer[6].txt (ID = 2481)
7:41 PM: Found Spy Cookie: clickzs cookie
7:41 PM: karin curtis@cz3.clickzs[2].txt (ID = 2413)
7:41 PM: Found Spy Cookie: overture cookie
7:41 PM: karin curtis@data2.perf.overture[1].txt (ID = 3106)
7:41 PM: karin curtis@data3.perf.overture[2].txt (ID = 3106)
7:41 PM: karin curtis@dc.about[1].txt (ID = 2038)
7:41 PM: karin curtis@deafness.about[1].txt (ID = 2038)
7:41 PM: Found Spy Cookie: dealtime cookie
7:41 PM: karin curtis@dealtime[2].txt (ID = 2505)
7:41 PM: karin curtis@delivery.inet-traffic[2].txt (ID = 2856)
7:41 PM: Found Spy Cookie: desktop kazaa cookie
7:41 PM: karin curtis@desktop.kazaa[2].txt (ID = 2515)
7:41 PM: Found Spy Cookie: did-it cookie
7:41 PM: karin curtis@did-it[1].txt (ID = 2523)
7:41 PM: Found Spy Cookie: directtrack cookie
7:41 PM: karin curtis@digitalmoses.directtrack[2].txt (ID = 2528)
7:41 PM: karin curtis@disney.go[1].txt (ID = 2729)
7:41 PM: karin curtis@dist.belnk[1].txt (ID = 2293)
7:41 PM: Found Spy Cookie: webservicehosts cookie
7:41 PM: karin curtis@dr.webservicehosts[1].txt (ID = 3663)
7:41 PM: karin curtis@drawsketch.about[1].txt (ID = 2038)
7:41 PM: Found Spy Cookie: localnrd cookie
7:41 PM: karin curtis@drk.localnrd[2].txt (ID = 2933)
7:41 PM: Found Spy Cookie: ru4 cookie
7:41 PM: karin curtis@edge.ru4[1].txt (ID = 3269)
7:41 PM: karin curtis@espn.go[1].txt (ID = 2729)
7:41 PM: Found Spy Cookie: exitexchange cookie
7:41 PM: karin curtis@exitexchange[2].txt (ID = 2633)
7:41 PM: karin curtis@experts.about[1].txt (ID = 2038)
7:41 PM: Found Spy Cookie: fastclick cookie
7:41 PM: karin curtis@fastclick[2].txt (ID = 2651)
7:41 PM: karin curtis@geography.about[1].txt (ID = 2038)
7:41 PM: Found Spy Cookie: go2net.com cookie
7:41 PM: karin curtis@go2net[1].txt (ID = 2730)
7:41 PM: Found Spy Cookie: gostats cookie
7:41 PM: karin curtis@gostats[1].txt (ID = 2747)
7:41 PM: Found Spy Cookie: gotoast cookie
7:41 PM: karin curtis@gotoast[1].txt (ID = 2751)
7:41 PM: karin curtis@go[2].txt (ID = 2728)
7:41 PM: karin curtis@hbmediapro[1].txt (ID = 2767)
7:41 PM: Found Spy Cookie: humanclick cookie
7:41 PM: karin curtis@hc2.humanclick[2].txt (ID = 2810)
7:41 PM: Found Spy Cookie: clickandtrack cookie
7:41 PM: karin curtis@hits.clickandtrack[2].txt (ID = 2397)
7:41 PM: Found Spy Cookie: hitstats.net cookie
7:41 PM: karin curtis@hitstats[2].txt (ID = 2791)
7:41 PM: Found Spy Cookie: homestore cookie
7:41 PM: karin curtis@homestore[2].txt (ID = 2793)
7:41 PM: karin curtis@honeymoons.about[1].txt (ID = 2038)
7:41 PM: Found Spy Cookie: hotmatch cookie
7:41 PM: karin curtis@hotmatch[1].txt (ID = 3854)
7:41 PM: Found Spy Cookie: qsrch cookie
7:41 PM: karin curtis@hs.qsrch[1].txt (ID = 3216)
7:41 PM: Found Spy Cookie: hypertracker.com cookie
7:41 PM: karin curtis@hypertracker[2].txt (ID = 2817)
7:41 PM: Found Spy Cookie: screensavers.com cookie
7:41 PM: karin curtis@i.screensavers[1].txt (ID = 3298)
7:41 PM: Found Spy Cookie: ic-live cookie
7:41 PM: karin curtis@ic-live[1].txt (ID = 2821)
7:41 PM: Found Spy Cookie: infospace cookie
7:41 PM: karin curtis@infospace[1].txt (ID = 2865)
7:41 PM: Found Spy Cookie: kount cookie
7:41 PM: karin curtis@kount[1].txt (ID = 2911)
7:41 PM: Found Spy Cookie: netster cookie
7:41 PM: karin curtis@lb3.netster[1].txt (ID = 3072)
7:41 PM: Found Spy Cookie: linksynergy cookie
7:41 PM: karin curtis@linksynergy[1].txt (ID = 2926)
7:41 PM: Found Spy Cookie: webtrends cookie
7:41 PM: karin curtis@m.webtrends[2].txt (ID = 3669)
7:41 PM: Found Spy Cookie: maxserving cookie
7:41 PM: karin curtis@maxserving[1].txt (ID = 2966)
7:41 PM: karin curtis@media.fastclick[2].txt (ID = 2652)
7:41 PM: Found Spy Cookie: mediaplex cookie
7:41 PM: karin curtis@mediaplex[1].txt (ID = 6442)
7:41 PM: Found Spy Cookie: metareward.com cookie
7:41 PM: karin curtis@metareward[1].txt (ID = 2990)
7:41 PM: karin curtis@microsofteup.112.2o7[1].txt (ID = 1958)
7:41 PM: karin curtis@microsoftwga.112.2o7[1].txt (ID = 1958)
7:41 PM: karin curtis@mobileoffice.about[1].txt (ID = 2038)
7:41 PM: karin curtis@movie-times.movies.go[1].txt (ID = 2729)
7:41 PM: karin curtis@movies.about[1].txt (ID = 2038)
7:41 PM: karin curtis@movies.go[2].txt (ID = 2729)
7:41 PM: Found Spy Cookie: mrskin cookie
7:41 PM: karin curtis@mrskin[1].txt (ID = 3020)
7:41 PM: karin curtis@msnportal.112.2o7[1].txt (ID = 1958)
7:41 PM: Found Spy Cookie: nextag cookie
7:41 PM: karin curtis@nextag[1].txt (ID = 5014)
7:41 PM: Found Spy Cookie: offeroptimizer cookie
7:41 PM: karin curtis@offeroptimizer[2].txt (ID = 3087)
7:41 PM: karin curtis@offeroptimizer[3].txt (ID = 3087)
7:41 PM: Found Spy Cookie: one-time-offer cookie
7:41 PM: karin curtis@one-time-offer[1].txt (ID = 3095)
7:41 PM: karin curtis@oneeconomy.122.2o7[1].txt (ID = 1958)
7:41 PM: karin curtis@partygaming.122.2o7[1].txt (ID = 1958)
7:41 PM: Found Spy Cookie: touchclarity cookie
7:41 PM: karin curtis@partypoker.touchclarity[1].txt (ID = 3567)
7:41 PM: Found Spy Cookie: partypoker cookie
7:41 PM: karin curtis@partypoker[1].txt (ID = 3111)
7:41 PM: Found Spy Cookie: paypopup cookie
7:41 PM: karin curtis@paypopup[1].txt (ID = 3119)
7:41 PM: Found Spy Cookie: pcstats.com cookie
7:41 PM: karin curtis@pcstats[1].txt (ID = 3125)
7:41 PM: Found Spy Cookie: peel network cookie
7:41 PM: karin curtis@peel[2].txt (ID = 3127)
7:41 PM: karin curtis@perf.overture[1].txt (ID = 3106)
7:41 PM: karin curtis@pittsburgh.about[1].txt (ID = 2038)
7:41 PM: Found Spy Cookie: mircx cookie
7:41 PM: karin curtis@pop.mircx[1].txt (ID = 2998)
7:41 PM: Found Spy Cookie: pricegrabber cookie
7:41 PM: karin curtis@pricegrabber[2].txt (ID = 3185)
7:41 PM: Found Spy Cookie: pro-market cookie
7:41 PM: karin curtis@pro-market[2].txt (ID = 3197)
7:41 PM: Found Spy Cookie: pub cookie
7:41 PM: karin curtis@pub[1].txt (ID = 3205)
7:41 PM: Found Spy Cookie: pynix cookie
7:41 PM: karin curtis@pyn.pynix[2].txt (ID = 3212)
7:41 PM: Found Spy Cookie: qksrv cookie
7:41 PM: karin curtis@qksrv[2].txt (ID = 3213)
7:41 PM: Found Spy Cookie: questionmarket cookie
7:41 PM: karin curtis@questionmarket[1].txt (ID = 3217)
7:41 PM: karin curtis@rapidresponse.directtrack[2].txt (ID = 2528)
7:41 PM: Found Spy Cookie: realmedia cookie
7:41 PM: karin curtis@realmedia[1].txt (ID = 3235)
7:41 PM: Found Spy Cookie: rednova cookie
7:41 PM: karin curtis@rednova[1].txt (ID = 3245)
7:41 PM: Found Spy Cookie: reunion cookie
7:41 PM: karin curtis@reunion[2].txt (ID = 3255)
7:41 PM: Found Spy Cookie: revenue.net cookie
7:41 PM: karin curtis@revenue[1].txt (ID = 3257)
7:41 PM: Found Spy Cookie: rightmedia cookie
7:41 PM: karin curtis@rightmedia[1].txt (ID = 3259)
7:41 PM: Found Spy Cookie: rn11 cookie
7:41 PM: karin curtis@rn11[1].txt (ID = 3261)
7:41 PM: Found Spy Cookie: adjuggler cookie
7:41 PM: karin curtis@rotator.adjuggler[2].txt (ID = 2071)
7:41 PM: karin curtis@rotator.dex.adjuggler[1].txt (ID = 2070)
7:41 PM: karin curtis@rsi.abc.go[1].txt (ID = 2729)
7:41 PM: karin curtis@rsi.abcnews.go[1].txt (ID = 2729)
7:41 PM: karin curtis@rsi.espn.go[1].txt (ID = 2729)
7:41 PM: Found Spy Cookie: coolsavings cookie
7:41 PM: karin curtis@sav.coolsavings[1].txt (ID = 2466)
7:41 PM: Found Spy Cookie: pch cookie
7:41 PM: karin curtis@sb.pch[1].txt (ID = 3124)
7:41 PM: Found Spy Cookie: domain sponsor cookie
7:41 PM: karin curtis@search.domainsponsor[1].txt (ID = 2534)
7:41 PM: karin curtis@search.movies.go[1].txt (ID = 2729)
7:41 PM: Found Spy Cookie: search123 cookie
7:41 PM: karin curtis@search123[1].txt (ID = 3305)
7:41 PM: Found Spy Cookie: techtarget cookie
7:41 PM: karin curtis@searchcrm.techtarget[2].txt (ID = 3500)
7:41 PM: karin curtis@sel.as-eu.falkag[1].txt (ID = 2650)
7:41 PM: karin curtis@sel.as-us.falkag[2].txt (ID = 2650)
7:41 PM: Found Spy Cookie: server.iad.liveperson cookie
7:41 PM: karin curtis@server.iad.liveperson[2].txt (ID = 3341)
7:41 PM: Found Spy Cookie: web-stat cookie
7:41 PM: karin curtis@server3.web-stat[2].txt (ID = 3649)
7:41 PM: Found Spy Cookie: serving-sys cookie
7:41 PM: karin curtis@serving-sys[1].txt (ID = 3343)
7:41 PM: Found Spy Cookie: servlet cookie
7:41 PM: karin curtis@servlet[2].txt (ID = 3345)
7:41 PM: karin curtis@servlet[3].txt (ID = 3345)
7:41 PM: karin curtis@sonycorporate.122.2o7[1].txt (ID = 1958)
7:41 PM: karin curtis@sonymediasoftware.122.2o7[1].txt (ID = 1958)
7:41 PM: karin curtis@spanish.about[1].txt (ID = 2038)
7:41 PM: Found Spy Cookie: specificpop cookie
7:41 PM: karin curtis@specificpop[1].txt (ID = 3401)
7:41 PM: karin curtis@sports.espn.go[1].txt (ID = 2729)
7:41 PM: Found Spy Cookie: starware.com cookie
7:41 PM: karin curtis@starware[2].txt (ID = 3441)
7:41 PM: karin curtis@stat.dealtime[2].txt (ID = 2506)
7:41 PM: Found Spy Cookie: statcounter cookie
7:41 PM: karin curtis@statcounter[1].txt (ID = 3447)
7:41 PM: Found Spy Cookie: stats.klsoft.com cookie
7:41 PM: karin curtis@stats.klsoft[1].txt (ID = 3451)
7:41 PM: Found Spy Cookie: reliablestats cookie
7:41 PM: karin curtis@stats1.reliablestats[2].txt (ID = 3254)
7:41 PM: Found Spy Cookie: webtrendslive cookie
7:41 PM: karin curtis@statse.webtrendslive[1].txt (ID = 3667)
7:41 PM: karin curtis@stubhub.122.2o7[1].txt (ID = 1958)
7:41 PM: karin curtis@tacoda[1].txt (ID = 6444)
7:41 PM: karin curtis@tattoo.about[2].txt (ID = 2038)
7:41 PM: Found Spy Cookie: teensforcash cookie
7:41 PM: karin curtis@teensforcash[2].txt (ID = 3509)
7:41 PM: karin curtis@thunderbolt.adjuggler[2].txt (ID = 2070)
7:41 PM: karin curtis@tickle[2].txt (ID = 3529)
7:41 PM: Found Spy Cookie: toprebates.com cookie
7:41 PM: karin curtis@toprebates[2].txt (ID = 3561)
7:41 PM: Found Spy Cookie: tracking cookie
7:41 PM: karin curtis@tracking[2].txt (ID = 3571)
7:41 PM: karin curtis@tracking[3].txt (ID = 3571)
7:41 PM: Found Spy Cookie: tradedoubler cookie
7:41 PM: karin curtis@tradedoubler[2].txt (ID = 3575)
7:41 PM: Found Spy Cookie: trafficmp cookie
7:41 PM: karin curtis@trafficmp[2].txt (ID = 3581)
7:41 PM: Found Spy Cookie: trb.com cookie
7:41 PM: karin curtis@trb[1].txt (ID = 3587)
7:41 PM: Found Spy Cookie: tribalfusion cookie
7:41 PM: karin curtis@tribalfusion[2].txt (ID = 3589)
7:41 PM: Found Spy Cookie: videodome cookie
7:41 PM: karin curtis@videodome[1].txt (ID = 3638)
7:41 PM: karin curtis@vip.clickzs[1].txt (ID = 2413)
7:41 PM: Found Spy Cookie: weborama cookie
7:41 PM: karin curtis@weborama[2].txt (ID = 3658)
7:41 PM: Found Spy Cookie: webpower cookie
7:41 PM: karin curtis@webpower[1].txt (ID = 3660)
7:41 PM: karin curtis@womenshealth.about[1].txt (ID = 2038)
7:41 PM: karin curtis@womensissues.about[1].txt (ID = 2038)
7:41 PM: karin curtis@wreport.weborama[2].txt (ID = 3659)
7:41 PM: karin curtis@www.888[1].txt (ID = 2020)
7:41 PM: Found Spy Cookie: adminder cookie
7:41 PM: karin curtis@www.adminder[2].txt (ID = 2079)
7:41 PM: Found Spy Cookie: brazilwelcomesyou cookie
7:41 PM: karin curtis@www.brazilwelcomesyou[1].txt (ID = 2325)
7:41 PM: Found Spy Cookie: burstbeacon cookie
7:41 PM: karin curtis@www.burstbeacon[2].txt (ID = 2335)
7:41 PM: Found Spy Cookie: ebates cookie
7:41 PM: karin curtis@www.ebates[1].txt (ID = 2558)
7:41 PM: Found Spy Cookie: epilot cookie
7:41 PM: karin curtis@www.epilot[1].txt (ID = 2622)
7:41 PM: Found Spy Cookie: expage cookie
7:41 PM: karin curtis@www.expage[2].txt (ID = 2638)
7:41 PM: karin curtis@www.metareward[1].txt (ID = 2991)
7:41 PM: Found Spy Cookie: myaffiliateprogram.com cookie
7:41 PM: karin curtis@www.myaffiliateprogram[2].txt (ID = 3032)
7:41 PM: karin curtis@www.rednova[2].txt (ID = 3246)
7:41 PM: karin curtis@www.screensavers[1].txt (ID = 3298)
7:41 PM: Found Spy Cookie: seeq cookie
7:41 PM: karin curtis@www.seeq[1].txt (ID = 3332)
7:41 PM: Found Spy Cookie: stlyrics cookie
7:41 PM: karin curtis@www.stlyrics[2].txt (ID = 3462)
7:41 PM: karin curtis@www.teensforcash[1].txt (ID = 3510)
7:41 PM: karin curtis@www.toprebates[2].txt (ID = 3562)
7:41 PM: karin curtis@www.web-stat[1].txt (ID = 3649)
7:41 PM: Found Spy Cookie: winantiviruspro cookie
7:41 PM: karin curtis@www.winantiviruspro[1].txt (ID = 3690)
7:41 PM: karin curtis@www48.seeq[1].txt (ID = 3332)
7:41 PM: karin curtis@www9.dealtime[1].txt (ID = 2506)
7:41 PM: Found Spy Cookie: xiti cookie
7:41 PM: karin curtis@xiti[1].txt (ID = 3717)
7:41 PM: Found Spy Cookie: xmatch cookie
7:41 PM: karin curtis@xmatch[1].txt (ID = 3719)
7:41 PM: Found Spy Cookie: yadro cookie
7:41 PM: karin curtis@yadro[1].txt (ID = 3743)
7:41 PM: karin curtis@yieldmanager[1].txt (ID = 3749)
7:41 PM: Found Spy Cookie: adserver cookie
7:41 PM: karin curtis@z1.adserver[1].txt (ID = 2142)
7:41 PM: karin curtis@zedo[1].txt (ID = 3762)
7:41 PM: Cookie Sweep Complete, Elapsed Time: 00:00:29
7:41 PM: Starting File Sweep
7:41 PM: Found Adware: bullguard popup ad
7:41 PM: c:\windows\temp\bullguard (1 subtraces) (ID = -2147476409)
7:43 PM: Found Adware: cydoor peer-to-peer dependency
7:43 PM: cd_clint.dll (ID = 57300)
7:45 PM: backup-20060416-130833-583.dll (ID = 274080)
7:46 PM: backup-20060416-131428-316.dll (ID = 274080)
7:49 PM: Found Adware: exact cashback/bargain buddy
7:49 PM: package8029_cdt3.exe (ID = 50800)
7:51 PM: Found Adware: 180search assistant/zango
7:51 PM: salmau.dat (ID = 93788)
7:52 PM: Found Adware: targetsaver
7:52 PM: pootz_58.exe (ID = 78250)
7:53 PM: bulldownload.exe (ID = 52017)
7:54 PM: Found Adware: altnet
7:54 PM: __unin__.exe (ID = 49795)
8:09 PM: byxwv.dll (ID = 274080)
8:19 PM: enhuninstall.exe (ID = 63348)
8:21 PM: salm_gdf.dat (ID = 93789)
8:21 PM: Found Adware: directrevenue-abetterinternet
8:21 PM: satmat.ini (ID = 83499)
8:21 PM: satmat.inf (ID = 83498)
8:21 PM: polall1r.inf (ID = 83425)
8:22 PM: Warning: Unhandled Archive Type
8:23 PM: Warning: Unhandled Archive Type
8:23 PM: File Sweep Complete, Elapsed Time: 00:42:06
8:24 PM: Full Sweep has completed. Elapsed time 00:46:46
8:24 PM: Traces Found: 509
8:24 PM: Removal process initiated
8:25 PM: Quarantining All Traces: 180search assistant/zango
8:25 PM: Quarantining All Traces: directrevenue-abetterinternet
8:25 PM: Quarantining All Traces: virtumonde
8:25 PM: virtumonde is in use. It will be removed on reboot.
8:25 PM: rqolm.dll is in use. It will be removed on reboot.
8:25 PM: C:\WINDOWS\system32\rqolm.dll is in use. It will be removed on reboot.
8:25 PM: Quarantining All Traces: blazefind
8:25 PM: Quarantining All Traces: powwa bar
8:25 PM: Quarantining All Traces: trojan-downloader-conhook
8:25 PM: ActiveX Shield: found: Trojan Horse: trojan-downloader-conhook, version 1.0.0.0 -- Installation denied
8:25 PM: trojan-downloader-conhook is in use. It will be removed on reboot.
8:25 PM: byxwv.dll is in use. It will be removed on reboot.
8:25 PM: byxwv.dll is in use. It will be removed on reboot.
8:25 PM: C:\WINDOWS\system32\byxwv.dll is in use. It will be removed on reboot.
8:25 PM: Quarantining All Traces: altnet
8:25 PM: Quarantining All Traces: bullguard popup ad
8:26 PM: Quarantining All Traces: cydoor peer-to-peer dependency
8:26 PM: Quarantining All Traces: drsnsrch hijacker
8:26 PM: Quarantining All Traces: ebates money maker
8:26 PM: Quarantining All Traces: exact cashback/bargain buddy
8:26 PM: Quarantining All Traces: ieplugin
8:26 PM: Quarantining All Traces: syncroad
8:26 PM: Quarantining All Traces: targetsaver
8:26 PM: Quarantining All Traces: 247realmedia cookie
8:26 PM: Quarantining All Traces: 2o7.net cookie
8:26 PM: Quarantining All Traces: 360i cookie
8:26 PM: Quarantining All Traces: 498 cookie
8:26 PM: Quarantining All Traces: 5 cookie
8:26 PM: Quarantining All Traces: 64.62.232 cookie
8:26 PM: Quarantining All Traces: 888 cookie
8:26 PM: Quarantining All Traces: a cookie
8:26 PM: Quarantining All Traces: aa cookie
8:26 PM: Quarantining All Traces: abetterinternet cookie
8:26 PM: Quarantining All Traces: about cookie
8:26 PM: Quarantining All Traces: accoona cookie
8:26 PM: Quarantining All Traces: adbureau cookie
8:26 PM: Quarantining All Traces: addynamix cookie
8:26 PM: Quarantining All Traces: adecn cookie
8:26 PM: Quarantining All Traces: adjuggler cookie
8:26 PM: Quarantining All Traces: adknowledge cookie
8:26 PM: Quarantining All Traces: adlegend cookie
8:26 PM: Quarantining All Traces: adminder cookie
8:26 PM: Quarantining All Traces: adprofile cookie
8:26 PM: Quarantining All Traces: adrevolver cookie
8:26 PM: Quarantining All Traces: adserver cookie
8:26 PM: Quarantining All Traces: adtech cookie
8:26 PM: Quarantining All Traces: adultfriendfinder cookie
8:26 PM: Quarantining All Traces: advertising cookie
8:26 PM: Quarantining All Traces: affiliate cookie
8:26 PM: Quarantining All Traces: alt cookie
8:26 PM: Quarantining All Traces: apmebf cookie
8:26 PM: Quarantining All Traces: ask cookie
8:26 PM: Quarantining All Traces: askmen cookie
8:26 PM: Quarantining All Traces: atlas dmt cookie
8:26 PM: Quarantining All Traces: atwola cookie
8:26 PM: Quarantining All Traces: azjmp cookie
8:26 PM: Quarantining All Traces: banner cookie
8:26 PM: Quarantining All Traces: barelylegal cookie
8:26 PM: Quarantining All Traces: belnk cookie
8:26 PM: Quarantining All Traces: bizrate cookie
8:26 PM: Quarantining All Traces: bluestreak cookie
8:26 PM: Quarantining All Traces: bpath cookie
8:26 PM: Quarantining All Traces: bravenet cookie
8:26 PM: Quarantining All Traces: brazilwelcomesyou cookie
8:26 PM: Quarantining All Traces: bs.serving-sys cookie
8:26 PM: Quarantining All Traces: btgrab cookie
8:26 PM: Quarantining All Traces: burstbeacon cookie
8:26 PM: Quarantining All Traces: burstnet cookie
8:26 PM: Quarantining All Traces: callwave cookie
8:26 PM: Quarantining All Traces: casalemedia cookie
8:26 PM: Quarantining All Traces: cassava cookie
8:26 PM: Quarantining All Traces: cc214142 cookie
8:26 PM: Quarantining All Traces: classmates cookie
8:26 PM: Quarantining All Traces: clickandtrack cookie
8:26 PM: Quarantining All Traces: clickbank cookie
8:26 PM: Quarantining All Traces: clickzs cookie
8:26 PM: Quarantining All Traces: cliks cookie
8:26 PM: Quarantining All Traces: coolsavings cookie
8:26 PM: Quarantining All Traces: customer cookie
8:26 PM: Quarantining All Traces: dealtime cookie
8:26 PM: Quarantining All Traces: desktop kazaa cookie
8:26 PM: Quarantining All Traces: did-it cookie
8:26 PM: Quarantining All Traces: directtrack cookie
8:26 PM: Quarantining All Traces: domain sponsor cookie
8:26 PM: Quarantining All Traces: ebates cookie
8:26 PM: Quarantining All Traces: enhance cookie
8:26 PM: Quarantining All Traces: epilot cookie
8:26 PM: Quarantining All Traces: euniverseads cookie
8:26 PM: Quarantining All Traces: exitexchange cookie
8:26 PM: Quarantining All Traces: expage cookie
8:26 PM: Quarantining All Traces: falkag cookie
8:26 PM: Quarantining All Traces: fastclick cookie
8:26 PM: Quarantining All Traces: go.com cookie
8:26 PM: Quarantining All Traces: go2net.com cookie
8:26 PM: Quarantining All Traces: gostats cookie
8:26 PM: Quarantining All Traces: gotoast cookie
8:26 PM: Quarantining All Traces: hbmediapro cookie
8:26 PM: Quarantining All Traces: hitstats.net cookie
8:26 PM: Quarantining All Traces: homestore cookie
8:26 PM: Quarantining All Traces: hotmatch cookie
8:26 PM: Quarantining All Traces: humanclick cookie
8:26 PM: Quarantining All Traces: hypertracker.com cookie
8:26 PM: Quarantining All Traces: ic-live cookie
8:26 PM: Quarantining All Traces: inet-traffic.com cookie
8:26 PM: Quarantining All Traces: infospace cookie
8:26 PM: Quarantining All Traces: kount cookie
8:26 PM: Quarantining All Traces: linksynergy cookie
8:26 PM: Quarantining All Traces: localnrd cookie
8:26 PM: Quarantining All Traces: maxserving cookie
8:26 PM: Quarantining All Traces: mediaplex cookie
8:26 PM: Quarantining All Traces: metareward.com cookie
8:26 PM: Quarantining All Traces: mircx cookie
8:26 PM: Quarantining All Traces: mrskin cookie
8:26 PM: Quarantining All Traces: myaffiliateprogram.com cookie
8:26 PM: Quarantining All Traces: netster cookie
8:26 PM: Quarantining All Traces: nextag cookie
8:26 PM: Quarantining All Traces: offeroptimizer cookie
8:26 PM: Quarantining All Traces: one-time-offer cookie
8:26 PM: Quarantining All Traces: overture cookie
8:26 PM: Quarantining All Traces: partypoker cookie
8:26 PM: Quarantining All Traces: paypopup cookie
8:26 PM: Quarantining All Traces: pch cookie
8:26 PM: Quarantining All Traces: pcstats.com cookie
8:26 PM: Quarantining All Traces: peel network cookie
8:26 PM: Quarantining All Traces: pointroll cookie
8:26 PM: Quarantining All Traces: precisead cookie
8:26 PM: Quarantining All Traces: pricegrabber cookie
8:26 PM: Quarantining All Traces: primaryads cookie
8:26 PM: Quarantining All Traces: pro-market cookie
8:26 PM: Quarantining All Traces: pub cookie
8:26 PM: Quarantining All Traces: pynix cookie
8:26 PM: Quarantining All Traces: qksrv cookie
8:26 PM: Quarantining All Traces: qsrch cookie
8:26 PM: Quarantining All Traces: questionmarket cookie
8:26 PM: Quarantining All Traces: realmedia cookie
8:26 PM: Quarantining All Traces: rednova cookie
8:26 PM: Quarantining All Traces: reliablestats cookie
8:26 PM: Quarantining All Traces: reunion cookie
8:26 PM: Quarantining All Traces: revenue.net cookie
8:26 PM: Quarantining All Traces: rightmedia cookie
8:26 PM: Quarantining All Traces: rn11 cookie
8:26 PM: Quarantining All Traces: ru4 cookie
8:26 PM: Quarantining All Traces: screensavers.com cookie
8:26 PM: Quarantining All Traces: search123 cookie
8:26 PM: Quarantining All Traces: seeq cookie
8:26 PM: Quarantining All Traces: server.iad.liveperson cookie
8:26 PM: Quarantining All Traces: serving-sys cookie
8:26 PM: Quarantining All Traces: servlet cookie
8:26 PM: Quarantining All Traces: specificclick.com cookie
8:26 PM: Quarantining All Traces: specificpop cookie
8:26 PM: Quarantining All Traces: starware.com cookie
8:26 PM: Quarantining All Traces: statcounter cookie
8:26 PM: Quarantining All Traces: stats.klsoft.com cookie
8:26 PM: Quarantining All Traces: stlyrics cookie
8:26 PM: Quarantining All Traces: tacoda cookie
8:26 PM: Quarantining All Traces: techtarget cookie
8:26 PM: Quarantining All Traces: teensforcash cookie
8:26 PM: Quarantining All Traces: tickle cookie
8:26 PM: Quarantining All Traces: toprebates.com cookie
8:26 PM: Quarantining All Traces: touchclarity cookie
8:26 PM: Quarantining All Traces: tracking cookie
8:26 PM: Quarantining All Traces: tradedoubler cookie
8:26 PM: Quarantining All Traces: trafficmp cookie
8:26 PM: Quarantining All Traces: trb.com cookie
8:26 PM: Quarantining All Traces: tribalfusion cookie
8:26 PM: Quarantining All Traces: videodome cookie
8:26 PM: Quarantining All Traces: weborama cookie
8:26 PM: Quarantining All Traces: webpower cookie
8:26 PM: Quarantining All Traces: webservicehosts cookie
8:26 PM: Quarantining All Traces: websponsors cookie
8:26 PM: Quarantining All Traces: web-stat cookie
8:26 PM: Quarantining All Traces: webtrends cookie
8:26 PM: Quarantining All Traces: webtrendslive cookie
8:26 PM: Quarantining All Traces: winantiviruspro cookie
8:26 PM: Quarantining All Traces: xiti cookie
8:26 PM: Quarantining All Traces: xmatch cookie
8:26 PM: Quarantining All Traces: yadro cookie
8:26 PM: Quarantining All Traces: yieldmanager cookie
8:26 PM: Quarantining All Traces: zedo cookie
8:26 PM: Warning: Timed out waiting for explorer.exe
8:26 PM: Warning: Unable to query service start type: The system cannot find the path specified
8:26 PM: Warning: Launched explorer.exe
8:26 PM: Warning: Quarantine process could not restart Explorer.
********
7:34 PM: | Start of Session, Sunday, April 16, 2006 |
7:34 PM: Spy Sweeper started
7:35 PM: Your spyware definitions have been updated.
7:37 PM: | End of Session, Sunday, April 16, 2006 |
Logfile of HijackThis v1.99.1
Scan saved at 8:33:45 PM, on 4/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\TOSHIBA\IVP\ISM\pinger.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
c:\Toshiba\Ivp\Swupdate\swupdtmr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.washingto...asia/index.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Pinger] C:\TOSHIBA\IVP\ISM\pinger.exe /run
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft....k/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by22fd.bay22....es/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) -
http://upload.facebo...otoUploader.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
http://messenger.zon...nt.cab31267.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) -
http://by22fd.bay22....ex/HMAtchmt.ocx
O20 - Winlogon Notify: byxwv - byxwv.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: Sebring - c:\WINDOWS\System32\LgNotify.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\Ivp\Swupdate\swupdtmr.exe