Logfile of HijackThis

Hello pr332 and Welcome to TomCoyote,

STEP 1.
======
Let’s check for Malware/Spyware on your computer which is best dealt with by spyware-removal programs used one after the other.

Spybot: Search and Destroy:
1.Download 'Spybot: Search And Destroy'.
2. Install it according to the instructions in 'How To Setup Spybot SD and Ad-Aware SE'.
3. Next, 'Search for Updates' as the definitions are not likely to be up-to-date.
4. Close ALL windows except Spybot SD
5. Click the "Check for Problems" button
6. Click 'Fix Selected Problems' and fix only the RED items.
7. REBOOT to finish removing what Spybot SD found and clear memory


Ad-Aware SE by Lavasoft:

1. Download 'Ad-Aware SE'.
2. Install according to the instructions in "How To Setup Spybot SD and Ad-Aware SE"
3. Next, 'Check for Updates' by clicking on the 'world globe' second from the right at the top of your Ad-Aware SE window.
4. Install the updates.
5. Close ALL windows except Ad-Aware SE
6. Click on 'Start' and choose 'full scan' for a full scan.
7. Quarantine anything that it finds and SAVE the log file.
8.REBOOT to finish removing what Ad-Aware SE found and clear memory.

Please let me know if anything can not be cleaned by these utilities.
Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Standard
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan:
• Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.

Copy and paste that information from Kapersky in your next post.


Scan again with HijackThis
POST a New HijackThis log here in this thread using 'Add Reply'.

Ad-Aware SE Build 1.06r1 Logfile Created on:Wednesday, July 12, 2006 12:13:33 AM Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R114 08.07.2006 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Coulomb Dialer(TAC index:5):2 total references MRU List(TAC index:0):43 total references Tracking Cookie(TAC index:3):28 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 7-12-2006 12:13:33 AM - Scan started. (Full System Scan) MRU List Object Recognized! Location: : C:\Documents and Settings\Chris Riewe\Application Data\microsoft\office\recent Description : list of recently opened documents using microsoft office MRU List Object Recognized! Location: : C:\Documents and Settings\Chris Riewe\recent Description : list of recently opened documents MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\google\navclient\1.1\history Description : list of recently used search terms in the google toolbar MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\internet explorer Description : last download directory used in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\internet explorer\main Description : last save directory used in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\internet explorer\typedurls Description : list of recently entered addresses in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\mediaplayer\medialibraryui Description : last selected node in the microsoft windows media player media library MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\mediaplayer\preferences Description : last playlist index loaded in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\mediaplayer\preferences Description : last playlist loaded in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\microsoft management console\recent file list Description : list of recent snap-ins used in the microsoft management console MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\office\11.0\common\general Description : list of recently used symbols in microsoft office MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\office\11.0\common\open find\microsoft office word\settings\new from existing document\file name mru Description : list of "new from existing document" files used by microsoft word MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\office\11.0\common\open find\microsoft office word\settings\open\file name mru Description : list of recent documents opened by microsoft word MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\office\11.0\common\open find\microsoft office word\settings\save as\file name mru Description : list of recent documents saved by microsoft word MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\office\11.0\powerpoint\recent file list Description : list of recent files used by microsoft powerpoint MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\office\11.0\word\recent templates Description : list of recent templates used by microsoft word MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\search assistant\acmru Description : list of recent search terms used with the search assistant MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\windows\currentversion\applets\paint\recent file list Description : list of files recently opened using microsoft paint MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\windows\currentversion\applets\regedit Description : last key accessed using the microsoft registry editor MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\windows\currentversion\applets\wordpad\recent file list Description : list of recent files opened using wordpad MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-18\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-18\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\windows\currentversion\explorer\recentdocs Description : list of recent documents opened MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\nico mak computing\winzip\filemenu Description : winzip recently used archives MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\realnetworks\realplayer\6.0\preferences Description : list of recent skins in realplayer MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\realnetworks\realplayer\6.0\preferences Description : list of recent clips in realplayer MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\realnetworks\realplayer\6.0\preferences Description : last login time in realplayer MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\smartftp\connection data Description : list of recently accessed servers using smartftp MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : S-1-5-21-1339132477-1738308201-3456066222-1006\software\microsoft\windows media\wmsdk\general Description : windows media sdk Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 628 ThreadCreationTime : 7-12-2006 3:53:02 AM BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 676 ThreadCreationTime : 7-12-2006 3:53:05 AM BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 796 ThreadCreationTime : 7-12-2006 3:53:23 AM BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 840 ThreadCreationTime : 7-12-2006 3:53:26 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 852 ThreadCreationTime : 7-12-2006 3:53:26 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1004 ThreadCreationTime : 7-12-2006 3:53:29 AM BasePriority : Normal FileVersion : 6.14.10.4114 ProductVersion : 6.14.10.4114.01 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1032 ThreadCreationTime : 7-12-2006 3:53:29 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1120 ThreadCreationTime : 7-12-2006 3:53:29 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [msmpeng.exe] FilePath : C:\Program Files\Windows Defender\ ProcessID : 1168 ThreadCreationTime : 7-12-2006 3:53:30 AM BasePriority : Normal FileVersion : 1.1.1347.0 ProductVersion : 1.1.1347.0 ProductName : Windows Defender CompanyName : Microsoft Corporation FileDescription : Service Executable InternalName : MsMpEng.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : MsMpEng.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1228 ThreadCreationTime : 7-12-2006 3:53:31 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1424 ThreadCreationTime : 7-12-2006 3:53:32 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:12 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1900 ThreadCreationTime : 7-12-2006 3:53:40 AM BasePriority : Normal FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) ProductVersion : 5.1.2600.2696 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:13 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 160 ThreadCreationTime : 7-12-2006 3:53:42 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:14 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 168 ThreadCreationTime : 7-12-2006 3:53:42 AM BasePriority : Normal FileVersion : 6.14.10.4114 ProductVersion : 6.14.10.4114.01 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:15 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 452 ThreadCreationTime : 7-12-2006 3:53:43 AM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:16 [isafe.exe] FilePath : C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ ProcessID : 484 ThreadCreationTime : 7-12-2006 3:53:44 AM BasePriority : Normal FileVersion : Version 11.0.6.7 ProductVersion : Version 11.0.6.7 ProductName : Computer Associates Antivirus CompanyName : Computer Associates International, Inc. FileDescription : CA ISafe Service InternalName : ISafe LegalCopyright : © 2004 Computer Associates International, Inc. LegalTrademarks : Trademark of Computer Associates International, Inc. OriginalFilename : ISafe.exe #:17 [dm1service.exe] FilePath : C:\Program Files\OLYMPUS\DeviceDetector\ ProcessID : 528 ThreadCreationTime : 7-12-2006 3:53:44 AM BasePriority : Normal FileVersion : 1, 2, 0, 0 ProductVersion : 1, 2, 0, 0 ProductName : DM1Service Module CompanyName : OLYMPUS Corporation FileDescription : DM1Servis Module InternalName : DM1Service LegalCopyright : Copyright © 2001-2003 OLYMPUS Corporation OriginalFilename : DM1Servis.EXE #:18 [g2svc.exe] FilePath : C:\Program Files\Citrix\GoToMyPC\ ProcessID : 564 ThreadCreationTime : 7-12-2006 3:53:45 AM BasePriority : Normal FileVersion : 5.0 Build 370 ProductVersion : 5.0 Build 370 ProductName : GoToMyPC CompanyName : Citrix Online FileDescription : GoToMyPC Host Loader InternalName : GoToMyPC Host Loader LegalCopyright : Copyright © 1997-2004 Citrix Online LLC OriginalFilename : g2svc.exe #:19 [appservices.exe] FilePath : C:\PROGRA~1\Iomega\System32\ ProcessID : 612 ThreadCreationTime : 7-12-2006 3:53:47 AM BasePriority : Normal FileVersion : 2, 0, 4, 2 ProductVersion : 2, 0, 4, 2 ProductName : Iomega App Services CompanyName : Iomega Corporation FileDescription : AppServices InternalName : AppServices LegalCopyright : Copyright © 2003 OriginalFilename : AppService.exe Comments : Iomega App Services For Windows NT/2000/XP #:20 [g2comm.exe] FilePath : C:\Program Files\Citrix\GoToMyPC\ ProcessID : 644 ThreadCreationTime : 7-12-2006 3:53:48 AM BasePriority : Above Normal #:21 [lssrvc.exe] FilePath : C:\Program Files\Common Files\LightScribe\ ProcessID : 652 ThreadCreationTime : 7-12-2006 3:53:48 AM BasePriority : Normal FileVersion : 1.4.30.1 ProductName : LightScribe CompanyName : Hewlett-Packard Company LegalCopyright : © Copyright 2003-2005 Hewlett-Packard Development Company, LP OriginalFilename : LSSrvc.exe #:22 [hpzipm12.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 752 ThreadCreationTime : 7-12-2006 3:53:51 AM BasePriority : Normal FileVersion : 9, 0, 0, 0 ProductVersion : 9, 0, 0, 0 ProductName : HP PML CompanyName : HP FileDescription : PML Driver InternalName : PmlDrv LegalCopyright : Copyright © 1998, 1999 Hewlett-Packard Company OriginalFilename : PmlDrv.exe #:23 [g2pre.exe] FilePath : C:\Program Files\Citrix\GoToMyPC\ ProcessID : 776 ThreadCreationTime : 7-12-2006 3:53:52 AM BasePriority : Normal FileVersion : 5.0 Build 370 ProductVersion : 5.0 Build 370 ProductName : GoToMyPC CompanyName : Citrix Online FileDescription : GoToMyPC Pre-Launcher plugin InternalName : GoToMyPC Pre-Launcher plugin LegalCopyright : Copyright © 1997-2004 Citrix Online LLC OriginalFilename : g2pre.exe #:24 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 816 ThreadCreationTime : 7-12-2006 3:53:52 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:25 [wdfmgr.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1280 ThreadCreationTime : 7-12-2006 3:53:54 AM BasePriority : Normal FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:26 [atiptaxx.exe] FilePath : C:\Program Files\ATI Technologies\ATI Control Panel\ ProcessID : 1352 ThreadCreationTime : 7-12-2006 3:53:54 AM BasePriority : Normal FileVersion : 6.14.10.5145 ProductVersion : 6.14.10.5145 ProductName : ATI Desktop Component CompanyName : ATI Technologies, Inc. FileDescription : ATI Desktop Control Panel InternalName : Atiptaxx.exe LegalCopyright : Copyright © 1998-2005 ATI Technologies Inc. OriginalFilename : Atiptaxx.exe #:27 [jusched.exe] FilePath : C:\Program Files\Java\jre1.5.0_06\bin\ ProcessID : 1412 ThreadCreationTime : 7-12-2006 3:53:54 AM BasePriority : Normal #:28 [hp wireless assistant.exe] FilePath : C:\Program Files\hpq\HP Wireless Assistant\ ProcessID : 1396 ThreadCreationTime : 7-12-2006 3:53:55 AM BasePriority : Normal FileVersion : 1, 1, 1, 2 ProductVersion : 1, 1, 1, 2 ProductName : hp Wireless Assistant CompanyName : Hewlett-Packard Company FileDescription : hp Wireless Assistant Module InternalName : hp Wireless Assistant LegalCopyright : Copyright 2004 OriginalFilename : hp Wireless Assistant.exe #:29 [vetmsg.exe] FilePath : C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ ProcessID : 1388 ThreadCreationTime : 7-12-2006 3:53:55 AM BasePriority : Normal FileVersion : Version 11.0.6.7 ProductVersion : Version 11.0.6.7 ProductName : Computer Associates Antivirus CompanyName : Computer Associates International, Inc. FileDescription : CA Antivirus Realtime Messaging Service InternalName : vetmsg LegalCopyright : © 2004 Computer Associates International, Inc. LegalTrademarks : Trademark of Computer Associates International, Inc. OriginalFilename : vetmsg.exe #:30 [g2tray.exe] FilePath : C:\Program Files\Citrix\GoToMyPC\ ProcessID : 1524 ThreadCreationTime : 7-12-2006 3:53:55 AM BasePriority : Normal FileVersion : 5.0 Build 370 ProductVersion : 5.0 Build 370 ProductName : GoToMyPC CompanyName : Citrix Online FileDescription : GoToMyPC Host Launcher InternalName : GoToMyPC Host Launcher LegalCopyright : Copyright © 1997-2004 Citrix Online LLC OriginalFilename : g2tray.exe #:31 [syntplpr.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 1532 ThreadCreationTime : 7-12-2006 3:53:55 AM BasePriority : Normal FileVersion : 7.13.0.1 02Feb05 ProductVersion : 7.13.0.1 02Feb05 ProductName : Synaptics Pointing Device Driver CompanyName : Synaptics, Inc. FileDescription : TouchPad Driver Helper Application InternalName : SynTPLpr LegalCopyright : Copyright © Synaptics, Inc. 1996-2004 OriginalFilename : SynTPLpr.exe #:32 [syntpenh.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 1556 ThreadCreationTime : 7-12-2006 3:53:56 AM BasePriority : Normal FileVersion : 7.13.0.1 02Feb05 ProductVersion : 7.13.0.1 02Feb05 ProductName : Synaptics Pointing Device Driver CompanyName : Synaptics, Inc. FileDescription : Synaptics TouchPad Enhancements InternalName : Synaptics Enhancements Application LegalCopyright : Copyright © Synaptics, Inc. 1996-2004 OriginalFilename : SynTPEnh.exe #:33 [hpwuschd2.exe] FilePath : C:\Program Files\Hp\HP Software Update\ ProcessID : 1576 ThreadCreationTime : 7-12-2006 3:53:56 AM BasePriority : Normal FileVersion : 50.0.146.000 ProductVersion : 050.000.146.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : Hewlett-Packard Product Assistant InternalName : hpwuSchd2 LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : hpwuSchd2.exe Comments : Hewlett-Packard Product Assistant #:34 [eabservr.exe] FilePath : C:\Program Files\HPQ\Quick Launch Buttons\ ProcessID : 1612 ThreadCreationTime : 7-12-2006 3:53:56 AM BasePriority : Normal FileVersion : 5, 1, 1, 2 ProductVersion : 5, 1, 1, 2 ProductName : Quick Launch Buttons CompanyName : Hewlett-Packard FileDescription : Quick Launch Buttons InternalName : eabsrvr LegalCopyright : © Copyright 2004 Hewlett-Packard Development Company, L.P. OriginalFilename : eabsrvr.exe #:35 [autolaunch.exe] FilePath : C:\Program Files\Iomega HotBurn Pro\ ProcessID : 1656 ThreadCreationTime : 7-12-2006 3:53:57 AM BasePriority : Normal FileVersion : 1.8 ProductVersion : 1.8 ProductName : Iomega HotBurn CompanyName : Iomega Corporation FileDescription : Iomega HotBurn Auto Launch Program InternalName : AutoLaunch LegalCopyright : Copyright © 2001-2002 Iomega Corporation LegalTrademarks : HOTBURN OriginalFilename : Autolaunch.exe Comments : HotBurn AutoLaunch Program #:36 [realsched.exe] FilePath : C:\Program Files\Common Files\Real\Update_OB\ ProcessID : 1724 ThreadCreationTime : 7-12-2006 3:53:58 AM BasePriority : Normal FileVersion : 0.1.0.3292 ProductVersion : 0.1.0.3292 ProductName : RealPlayer (32-bit) CompanyName : RealNetworks, Inc. FileDescription : RealNetworks Scheduler InternalName : schedapp LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004 LegalTrademarks : RealAudio™ is a trademark of RealNetworks, Inc. OriginalFilename : realsched.exe #:37 [cavtray.exe] FilePath : C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ ProcessID : 2108 ThreadCreationTime : 7-12-2006 3:54:01 AM BasePriority : Normal FileVersion : Version 11.0.6.7 ProductVersion : Version 11.0.6.7 ProductName : Computer Associates Antivirus CompanyName : Computer Associates International, Inc. FileDescription : CA Antivirus System Tray Application InternalName : CAVTray LegalCopyright : © 2004 Computer Associates International, Inc. LegalTrademarks : Trademark of Computer Associates International, Inc. OriginalFilename : CAVTray.exe #:38 [cavrid.exe] FilePath : C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ ProcessID : 2128 ThreadCreationTime : 7-12-2006 3:54:01 AM BasePriority : Normal FileVersion : Version 11.0.6.7 ProductVersion : Version 11.0.6.7 ProductName : Computer Associates Antivirus CompanyName : Computer Associates International, Inc. FileDescription : CA Antivirus Realtime Infection Report InternalName : CAVRid LegalCopyright : © 2004 Computer Associates International, Inc. LegalTrademarks : Trademark of Computer Associates International, Inc. OriginalFilename : CAVRid.exe #:39 [qttask.exe] FilePath : C:\Program Files\QuickTime\ ProcessID : 2148 ThreadCreationTime : 7-12-2006 3:54:03 AM BasePriority : Normal FileVersion : 7.0.4 ProductVersion : QuickTime 7.0.4 ProductName : QuickTime CompanyName : Apple Computer, Inc. FileDescription : QuickTime Task InternalName : QuickTime Task LegalCopyright : Copyright Apple Computer, Inc. 1989-2006 OriginalFilename : QTTask.exe #:40 [issch.exe] FilePath : C:\Program Files\Common Files\InstallShield\UpdateService\ ProcessID : 2244 ThreadCreationTime : 7-12-2006 3:54:03 AM BasePriority : Normal FileVersion : 3, 10, 100, 1155 ProductVersion : 3, 10 ProductName : InstallShield Update Service CompanyName : InstallShield Software Corporation FileDescription : InstallShield Update Service Scheduler InternalName : Scheduler LegalCopyright : Copyright © 1990-2004 InstallShield Software Corporation OriginalFilename : issch.exe #:41 [ituneshelper.exe] FilePath : C:\Program Files\iTunes\ ProcessID : 2292 ThreadCreationTime : 7-12-2006 3:54:04 AM BasePriority : Normal FileVersion : 6.0.4.2 ProductVersion : 6.0.4.2 ProductName : iTunes CompanyName : Apple Computer, Inc. FileDescription : iTunesHelper Module InternalName : iTunesHelper LegalCopyright : © 2003-2006 Apple Computer, Inc. All Rights Reserved. OriginalFilename : iTunesHelper.exe #:42 [msascui.exe] FilePath : C:\Program Files\Windows Defender\ ProcessID : 2320 ThreadCreationTime : 7-12-2006 3:54:05 AM BasePriority : Normal FileVersion : 1.1.1347.0 ProductVersion : 1.1.1347.0 ProductName : Windows Defender CompanyName : Microsoft Corporation FileDescription : Windows Defender User Interface InternalName : MSASCUI LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : MSASCUI.exe #:43 [ctfmon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2376 ThreadCreationTime : 7-12-2006 3:54:07 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : CTF Loader InternalName : CTFMON LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : CTFMON.EXE #:44 [wcescomm.exe] FilePath : C:\Program Files\Microsoft ActiveSync\ ProcessID : 2408 ThreadCreationTime : 7-12-2006 3:54:08 AM BasePriority : Normal FileVersion : 4.1.4841.0 ProductVersion : 4.1.4841 ProductName : Microsoft ActiveSync CompanyName : Microsoft Corporation FileDescription : ActiveSync Connection Manager InternalName : wcescomm LegalCopyright : Copyright © 1995-2004 Microsoft Corp. All rights reserved. LegalTrademarks : Microsoft® and Windows® are registered trademarks of Microsoft Corporation. OriginalFilename : WCESCOMM.EXE #:45 [xpressmaildesktopclient.exe] FilePath : C:\Program Files\Xpress Mail\Personal Edition\ ProcessID : 2592 ThreadCreationTime : 7-12-2006 3:54:10 AM BasePriority : Normal FileVersion : 6, 5, 5, 189 ProductVersion : 6, 5, 5, 189 LegalCopyright : Copyright © 2000-2003. #:46 [rapimgr.exe] FilePath : C:\PROGRA~1\MI3AA1~1\ ProcessID : 2760 ThreadCreationTime : 7-12-2006 3:54:12 AM BasePriority : Normal FileVersion : 4.1.4841.0 ProductVersion : 4.1.4841 ProductName : Microsoft ActiveSync CompanyName : Microsoft Corporation FileDescription : ActiveSync RAPI Manager InternalName : rapimgr LegalCopyright : Copyright © 1995-2004 Microsoft Corp. All rights reserved. LegalTrademarks : Microsoft® and Windows® are registered trademarks of Microsoft Corporation. OriginalFilename : rapimgr.exe #:47 [wmiprvse.exe] FilePath : C:\WINDOWS\system32\wbem\ ProcessID : 3120 ThreadCreationTime : 7-12-2006 3:54:15 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : WMI InternalName : Wmiprvse.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : Wmiprvse.exe #:48 [ipodservice.exe] FilePath : C:\Program Files\iPod\bin\ ProcessID : 3160 ThreadCreationTime : 7-12-2006 3:54:17 AM BasePriority : Normal FileVersion : 6.0.4.2 ProductVersion : 6.0.4.2 ProductName : iTunes CompanyName : Apple Computer, Inc. FileDescription : iPodService Module InternalName : iPodService LegalCopyright : © 2003-2006 Apple Computer, Inc. All Rights Reserved. OriginalFilename : iPodService.exe #:49 [connectionservice.exe] FilePath : C:\Program Files\Xpress Mail\Personal Edition\ ProcessID : 3400 ThreadCreationTime : 7-12-2006 3:54:19 AM BasePriority : Normal #:50 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 3560 ThreadCreationTime : 7-12-2006 3:54:20 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:51 [connection.exe] FilePath : C:\Program Files\Xpress Mail\Personal Edition\ ProcessID : 4056 ThreadCreationTime : 7-12-2006 3:54:22 AM BasePriority : Normal #:52 [hpqwmi.exe] FilePath : C:\Program Files\HPQ\SHARED\ ProcessID : 4080 ThreadCreationTime : 7-12-2006 3:54:25 AM BasePriority : Normal FileVersion : 1, 0, 4, 3 ProductVersion : 1, 0, 4, 3 ProductName : hpqwmi Module CompanyName : Hewlett-Packard Development Company, L.P. FileDescription : hpqwmi Module InternalName : hpqwmi LegalCopyright : © Copyright 2003, 2005 Hewlett-Packard Development Company, L.P. OriginalFilename : hpqwmi.EXE #:53 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 2268 ThreadCreationTime : 7-12-2006 3:55:37 AM BasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 43 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 43 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 43 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : chris [removed][2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:6 Value : Cookie:chris [removed]/ Expires : 12-31-2020 8:00:00 PM LastSync : Hits:6 UseCount : 0 Hits : 6 Tracking Cookie Object Recognized! Type : IECache Entry Data : chris riewe@live365[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:15 Value : Cookie:chris [removed]/ Expires : 6-10-2011 11:00:38 PM LastSync : Hits:15 UseCount : 0 Hits : 15 Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 2 Objects found so far: 45 Coulomb Dialer Object Recognized! Type : File Data : Groove.x32 TAC Rating : 5 Category : Dialer Comment : Object : C:\Documents and Settings\Allison Riewe\Application Data\Macromedia\Shockwave Player\xtras\download\TheGrooveAlliance\3DGrooveXtrav181\ FileVersion : 1, 8, 1, 0 ProductVersion : 1, 8, 1, 0 ProductName : GROOVE FileDescription : GROOVE InternalName : GROOVE LegalCopyright : Copyright 2001 OriginalFilename : GROOVE.x32 Tracking Cookie Object Recognized! Type : IECache Entry Data : allison riewe@2o7[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison riewe@2o7[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : allison [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison [removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : allison [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison [removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : allison riewe@atdmt[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison riewe@atdmt[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : allison riewe@doubleclick[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison riewe@doubleclick[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : allison riewe@mediaplex[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison riewe@mediaplex[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : allison riewe@questionmarket[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison riewe@questionmarket[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : allison riewe@serving-sys[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison riewe@serving-sys[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : allison riewe@statcounter[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Allison Riewe\Cookies\allison riewe@statcounter[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@2o7[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@2o7[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina [removed][2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina [removed][2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@atdmt[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@atdmt[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina [removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@doubleclick[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@doubleclick[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@edge.ru4[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@edge.ru4[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina [removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@live365[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@live365[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@mediaplex[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@mediaplex[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@overture[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@overture[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@questionmarket[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@questionmarket[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@realmedia[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@realmedia[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@serving-sys[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina riewe@serving-sys[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina [removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Cookies\elaina [removed][1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@doubleclick[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Local Settings\Temp\Cookies\elaina riewe@doubleclick[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : elaina riewe@real[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : C:\Documents and Settings\Elaina Riewe\Local Settings\Temp\Cookies\elaina riewe@real[1].txt Coulomb Dialer Object Recognized! Type : File Data : AtlBrowser.exe TAC Rating : 5 Category : Dialer Comment : Object : C:\Program Files\Online Services\PeoplePC\Utilities\ FileVersion : 5, 5, 0, 6 ProductVersion : 5, 0, 0, 0 ProductName : AtlBrowser Module CompanyName : PeoplePC FileDescription : AtlBrowser Module InternalName : ATLBROWSER LegalCopyright : Copyright 2003 OriginalFilename : ATLBROWSER.DLL Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 73 Scanning Hosts file…… Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 2020 entries scanned. New critical objects:0 Objects found so far: 73 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 73 12:25:32 AM Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:11:58.906 Objects scanned:200574 Objects identified:30 Objects ignored:0 New critical objects:30 ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Wednesday, July 12, 2006 10:45:22 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 12/07/2006 Kaspersky Anti-Virus database records: 194433 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 86690 Number of viruses found: 1 Number of infected objects: 3 / 0 Number of suspicious objects: 0 Duration of the scan process: 02:03:50 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-06042006-121619.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\0102\0310\values Object is locked skipped C:\Documents and Settings\Chris Riewe\Application Data\$_hpcst$.hpc Object is locked skipped C:\Documents and Settings\Chris Riewe\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Chris Riewe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Chris Riewe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Chris Riewe\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{41287B4F-FACF-4B0A-BD5E-9C21EC3AFD1C} Object is locked skipped C:\Documents and Settings\Chris Riewe\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Chris Riewe\Local Settings\History\History.IE5\MSHist012006071220060713\index.dat Object is locked skipped C:\Documents and Settings\Chris Riewe\Local Settings\Temp\WCESLog.log Object is locked skipped C:\Documents and Settings\Chris Riewe\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Chris Riewe\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Chris Riewe\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Chris Riewe\UserData\index.dat Object is locked skipped C:\Documents and Settings\Elaina Riewe\Application Data\$_hpcst$.hpc Object is locked skipped C:\Documents and Settings\Elaina Riewe\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Elaina Riewe\Local Settings\Application Data\Identities\{445BA929-0754-421E-B2F9-D5F440A69141}\Microsoft\Outlook Express\Norton AntiSpam Folder.dbx/[From [Norton AntiSpam] Private message from eBay][Date Mon, 15 Aug 2005 00:06:58 -0700]/UNNAMED/html Infected: Trojan-Spy.HTML.Bayfraud.hn skipped C:\Documents and Settings\Elaina Riewe\Local Settings\Application Data\Identities\{445BA929-0754-421E-B2F9-D5F440A69141}\Microsoft\Outlook Express\Norton AntiSpam Folder.dbx/[From [Norton AntiSpam] Private message from eBay][Date Mon, 15 Aug 2005 00:06:58 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.hn skipped C:\Documents and Settings\Elaina Riewe\Local Settings\Application Data\Identities\{445BA929-0754-421E-B2F9-D5F440A69141}\Microsoft\Outlook Express\Norton AntiSpam Folder.dbx Mail MS Outlook 5: infected - 2 skipped C:\Documents and Settings\Elaina Riewe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Elaina Riewe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Elaina Riewe\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{684B3ECD-D302-4BAD-A07A-4730D012CB4D} Object is locked skipped C:\Documents and Settings\Elaina Riewe\Local Settings\History\History.IE5\

Hello pr332,

Your Kapersky scan looks fine since the infected items are in the Anti-Spam folder.

Let's try to do another Ad-aware scan

Since you already have downloaded it, skip the download and Step 1.

=======================================
SKIP THIS PART
Now for Ad-Aware : available from here.

1. Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan
========================================
2.Close ALL windows except Ad-Aware SE

3. Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.

4. Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window

1) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

Under Definitions:
*Prompt to udate outdated definitions - set the number of days

2) Click on the ‘Scanning’ button on the left and select in green :

Under Driver, Folders & Files:
*Scan Within Archives

Under Select drives & folders to scan -
*choose all hard drives

Under Memory & Registry: all green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file

3) Click on the ‘Advanced’ button on the left and select in green:

Under Shell Integration:
*Move deleted files to recycle bin

Under Logfile Detail Level: (all green)
*include addtional object information
*DESELECT - include negligible objects information
*include environment information

Under Alternate Data Streams:
*Don't log streams smaller than 0 bytes
*Don't log ADS with the following names: CA_INOCULATEIT

4) Click the ‘Tweak’ button and select in green:

Under the ‘Scanning Engine’:
*Unload recognized processes during scanning
*Scan registry for all users instead of current user only

Under the ‘Cleaning Engine’:
*Let Windows remove files in use at next reboot

Under the Log Files:
*Include basic Ad-aware SE settings in logfile
*Include additional Ad-aware SE settings in logfile
*Please do not check and make Green: Include Module list in logfile


5. Click on ‘Proceed’ to save the settings.

6. Click ‘Start’

*Choose:'Perform Full System Scan'
*DESELECT "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat.

7. Click ‘Next’ and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically.

8. If Ad-Aware SE finds bad entries in the registry or bad files, you will receive a list of what it found in the window

9. Save the log file when it asks and then click ‘finish’

10. REBOOT to complete the removal of what Ad-Aware SE found

Please let me know if anything can not be cleaned by these utilities.

Now post (reply) with a fresh hijackthis log.

Updating Java:

• Go to Start > Control Panel double-click on the Software icon > add/remove programs.
• Search in the list for all previous installed versions of Java. (J2SE Runtime Environment…. )
  It should have next icon next to it: [external image: Posted Image]
  Select it and click Remove.
• Then Download and install the newest version from here:http://www.java.com/en/download/manual.jsp

Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
• Click on Tools, General Settings.
• Under Real-time protection options, unselect the Turn on real-time protection check box
• Click Save

After all of the fixes are complete it is very important that you enable Real-time Protection again.

Scan with HijackThis. Place a check against each of the following:
O20 - AppInit_DLLs:
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Post back a fresh HijackThis log and we will take another look.

Hello pr332,

Your hijackthis log appears to be clean. However, I did not notice a firewall application in it. Are you just depending on the Windows XP firewall? Please read the information below about firewalls.

Please do the following:

STEP 1.
======
Cleanmgr
To clean temporary files:

• Go > start > run and type cleanmgr and click OK
• Scan your system for files to remove.
• Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
• Click OK to remove those files.
• Click Yes to confirm deletion.

STEP 2.( Windows XP only)
======
Prefetch Folder
Open C:\Windows\Prefetch\
Delete All files in this folder but not the Prefetch folder

STEP 3.
======
System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

• Turn off System Restore.
• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Reboot.

Turn ON System Restore.

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check *Turn off System Restore*.
• Click Apply, and then click OK.

STEP 4.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly.
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  Understanding and Using Firewalls
  
  
• Test your Firewall - Please test your firewall and make sure it is working properly.
  Test Firewall
  
  
• Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  A tutorial on installing & using this product can be found here:
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  A tutorial on installing & using this product can be found here:
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  A tutorial on installing & using this product can be found here:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
  
  
• More info on how to prevent malware you can also find here (By Tony Klein)

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php