Hello, thank you for the reply, I have finished all the scans now and I will post the logs in a second, but I wanted to say a few things first. The first thing is when you said in green text if I used spyblaster or IE I had to enable the protection again or something? I use internet explorer as my browser, so how do I re-protect myself? I dont understand what you mean when you said "run the batch file". Also with spysweeper I had some troubles with the program, first time I scanned I forgot to show extensions for known formats so I stopped it 5 minutes in, second time it froze on some file it was trying to scan (it was a demo of a game i downloaded) so I had to ctrl+alt+del and end it, then I rebooted and erased the demo (I didn't want it anyway! lol). Then when I started spysweeper again it said something in my host file was changed and to fix it. It was from a lineage2 server so I hit fix as I did not want those anymore, I am sure it is all in the log, I am sorry if I did something wrong, here are the logs. Oh one more thing, when I was running ewido and it found a tracker cookie it didn't say clean it only had actions, remove, or none. so I did remove hope thats ok.
********
6:31 PM: | Start of Session, Saturday, June 17, 2006 |
6:31 PM: Spy Sweeper started
6:31 PM: Sweep initiated using definitions version 701
6:31 PM: Starting Memory Sweep
6:34 PM: Memory Sweep Complete, Elapsed Time: 00:02:13
6:34 PM: Starting Registry Sweep
6:34 PM: Registry Sweep Complete, Elapsed Time:00:00:08
6:34 PM: Starting Cookie Sweep
6:34 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
6:34 PM: Starting File Sweep
6:41 PM: Found Adware: bingofun games
6:41 PM: lt33xg.mid (ID = 51219)
6:52 PM: Warning: Unable to sweep compressed file: System Error. Code: 8.
Not enough storage is available to process this command
6:52 PM: Warning: Unable to sweep compressed file: System Error. Code: 5.
Access is denied
6:52 PM: Warning: Unable to sweep compressed file: System Error. Code: 5.
Access is denied
6:52 PM: Warning: Unhandled Archive Type
6:52 PM: Warning: Unhandled Archive Type
6:52 PM: Warning: Unhandled Archive Type
6:52 PM: Warning: Unhandled Archive Type
6:52 PM: Warning: Unhandled Archive Type
6:52 PM: Warning: Unable to sweep compressed file: System Error. Code: 8.
Not enough storage is available to process this command
6:53 PM: Warning: Unhandled Archive Type
6:55 PM: Warning: Unhandled Archive Type
6:57 PM: Warning: Unable to sweep compressed file: System Error. Code: 8.
Not enough storage is available to process this command
6:57 PM: Warning: Unhandled Archive Type
6:57 PM: Warning: Unhandled Archive Type
6:57 PM: Warning: Unhandled Archive Type
6:57 PM: Warning: Unhandled Archive Type
6:57 PM: Warning: Unhandled Archive Type
6:57 PM: Warning: Unhandled Archive Type
6:57 PM: Warning: Unhandled Archive Type
6:57 PM: Warning: Unhandled Archive Type
6:57 PM: File Sweep Complete, Elapsed Time: 00:23:28
6:57 PM: Full Sweep has completed. Elapsed time 00:25:51
6:57 PM: Traces Found: 1
6:58 PM: Removal process initiated
6:58 PM: Quarantining All Traces: bingofun games
6:58 PM: Removal process completed. Elapsed time 00:00:00
********
5:42 PM: | Start of Session, Saturday, June 17, 2006 |
5:42 PM: Spy Sweeper started
5:42 PM: Sweep initiated using definitions version 701
5:42 PM: Starting Memory Sweep
5:44 PM: Memory Sweep Complete, Elapsed Time: 00:02:25
5:44 PM: Starting Registry Sweep
5:44 PM: Registry Sweep Complete, Elapsed Time:00:00:09
5:44 PM: Starting Cookie Sweep
5:44 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
5:44 PM: Starting File Sweep
5:52 PM: Found Adware: bingofun games
5:52 PM: lt33xg.mid (ID = 51219)
6:03 PM: Warning: Unable to sweep compressed file: System Error. Code: 8.
Not enough storage is available to process this command
6:03 PM: Warning: Unable to sweep compressed file: System Error. Code: 5.
Access is denied
6:03 PM: Warning: Unable to sweep compressed file: System Error. Code: 5.
Access is denied
6:04 PM: Warning: Unhandled Archive Type
6:04 PM: Warning: Unhandled Archive Type
6:04 PM: Warning: Unhandled Archive Type
6:04 PM: Warning: Unhandled Archive Type
6:04 PM: Warning: Unhandled Archive Type
6:04 PM: Warning: Unable to sweep compressed file: System Error. Code: 8.
Not enough storage is available to process this command
6:05 PM: Warning: Unhandled Archive Type
6:06 PM: Warning: Unhandled Archive Type
6:26 PM: Sweep Canceled
6:31 PM: Processing Hosts File Alerts
6:31 PM: Fixed Hosts File entry: L2authd.lineage2.com
6:31 PM: Fixed Hosts File entry: L2testauthd.lineage2.com
6:31 PM: | End of Session, Saturday, June 17, 2006 |
********
5:33 PM: | Start of Session, Saturday, June 17, 2006 |
5:33 PM: Spy Sweeper started
5:33 PM: Sweep initiated using definitions version 701
5:33 PM: Starting Memory Sweep
5:37 PM: Memory Sweep Complete, Elapsed Time: 00:03:40
5:37 PM: Starting Registry Sweep
5:37 PM: Registry Sweep Complete, Elapsed Time:00:00:09
5:37 PM: Starting Cookie Sweep
5:37 PM: Found Spy Cookie: about cookie
5:37 PM: user@about[2].txt (ID = 2037)
5:37 PM: Found Spy Cookie: yieldmanager cookie
5:37 PM: user@ad.yieldmanager[1].txt (ID = 3751)
5:37 PM: Found Spy Cookie: atlas dmt cookie
5:37 PM: user@atdmt[2].txt (ID = 2253)
5:37 PM: user@compactiongames.about[2].txt (ID = 2038)
5:37 PM: Found Spy Cookie: overture cookie
5:37 PM: user@data4.perf.overture[1].txt (ID = 3106)
5:37 PM: Found Spy Cookie: wtlive.com cookie
5:37 PM: user@dcstest.wtlive[1].txt (ID = 3700)
5:37 PM: Found Spy Cookie: fastclick cookie
5:37 PM: user@fastclick[2].txt (ID = 2651)
5:37 PM: Found Spy Cookie: tacoda cookie
5:37 PM: user@tacoda[2].txt (ID = 6444)
5:37 PM: Found Spy Cookie: tribalfusion cookie
5:37 PM: user@tribalfusion[1].txt (ID = 3589)
5:37 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
5:37 PM: Starting File Sweep
5:38 PM: Sweep Canceled
5:38 PM: File Sweep Complete, Elapsed Time: 00:01:12
5:38 PM: Traces Found: 9
5:38 PM: Removal process initiated
5:38 PM: Quarantining All Traces: about cookie
5:38 PM: Quarantining All Traces: atlas dmt cookie
5:38 PM: Quarantining All Traces: fastclick cookie
5:38 PM: Quarantining All Traces: overture cookie
5:38 PM: Quarantining All Traces: tacoda cookie
5:38 PM: Quarantining All Traces: tribalfusion cookie
5:38 PM: Quarantining All Traces: wtlive.com cookie
5:38 PM: Quarantining All Traces: yieldmanager cookie
5:38 PM: Removal process completed. Elapsed time 00:00:00
********
5:30 PM: | Start of Session, Saturday, June 17, 2006 |
5:30 PM: Spy Sweeper started
5:31 PM: Your spyware definitions have been updated.
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 7:26:55 PM, 6/17/2006
+ Report-Checksum: A612F481
+ Scan result:
C:\Documents and Settings\User\Cookies\user@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned with backup
C:\Documents and Settings\User\Cookies\user@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
::Report End
Logfile of HijackThis v1.99.1
Scan saved at 7:27:41 PM, on 6/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Tyson\hijackthis.exe
O1 - Hosts: 206.222.29.130 L2authd.lineage2.com
O1 - Hosts: 206.222.29.130 L2testauthd.lineage2.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) -
http://www.fileplane...DC_2.2.1.87.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.micros...b?1142492615593
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -
http://launch.gamesp...nch/alaunch.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{42742643-1B40-4A7C-A175-FFFA80806D96}: NameServer = 192.168.10.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe