Spyware / Malware / Virus Removal

HjackThis log

17 min read

Looking for the outcome? Ask AI

bns2000 Topic Starter

Post #1August 4, 2006, 9:04 PM UTC last edited August 4, 2006, 9:05 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 3:51:08 PM, on 8/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINNT\system32\slserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\SpamBlockerUtility\Bin\4.6.1.0\SbOEAddOn.exe
C:\WINNT\system32\a77g9cc5.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe
C:\Program Files\Winamp\winampa.exe
C:\winnt\system32\pumd.exe
C:\winnt\system32\gdimx.exe
C:\program files\common files\system\mplay64.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\explorer.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\Documents and Settings\sup\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/…://my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.321search.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://59.148.220.121/trafc-2.1/rfe.php?cm…tes2&nid=go
R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [SYFMSZC] C:\WINNT\SYFMSZC.exe
O4 - HKLM\..\Run: [VDN] C:\WINNT\VDN.exe
O4 - HKLM\..\Run: [CPZHRNX] C:\WINNT\CPZHRNX.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Kovxmpo] C:\Program Files\Kghasf\Fajqp.exe
O4 - HKLM\..\Run: [SpamBlocker] C:\Program Files\SpamBlockerUtility\Bin\4.6.1.0\SbOEAddOn.exe
O4 - HKLM\..\Run: [Spam Blocker for Outlook Express] C:\PROGRA~1\SPAMBL~1\Bin\461~1.0\SBInst.exe
O4 - HKLM\..\Run: [a77g9cc5] C:\WINNT\system32\a77g9cc5.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ML1HelperStartUp] C:\PROGRA~1\MIDNIG~1\ML1HEL~1.EXE /partner ML1
O4 - HKLM\..\Run: [LaunchPDeviceConn] "C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [pumd] c:\winnt\system32\pumd.exe /nocomm
O4 - HKLM\..\Run: [Build new corn trans] C:\Documents and Settings\All Users\Application Data\flawskipbuildnew\DRAWPHONE.exe
O4 - HKLM\..\Run: [gdimx] c:\winnt\system32\gdimx.exe /nocomm
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [WorkFlow] D:\Install\WorkFlow.exe
O4 - HKLM\..\Run: [DriveCleaner 2006 Free] "C:\Program Files\DriveCleaner 2006 Free\UDC2006.exe" /min
O4 - HKLM\..\Run: [mplay64] c:\program files\common files\system\mplay64.exe /noerrorinfo
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\RunServices: [Windows Recycler] damlmyx.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: palstart.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Firewall service (FWSvc) - Unknown owner - C:\Program Files\WinAntiVirus Pro 2006\FWSvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

TY for the help in Advance

ken545

Post #2August 5, 2006, 12:38 AM UTC last edited August 5, 2006, 2:48 AM UTC

bns2000

Welcome to the forum, you have quite a bit going on, lets do this….

DO THIS FIRST
Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.Wk

Easy to fix,
* just go to My Computer > YOUR C:\ DRIVE > Program Files and create a new folder and name it Hijackthis .
* Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
* Now open the new folder you just created and right click within that folder and select PASTE .
* Now HJT should reside in C:\Program Files\Hijackthis\Hijackthis.exe

Please do not proceed until you have moved HJT

We need to make sure all hidden files are showing :

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide file extensions for known types option.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Some info for you, these are all bogus programs and if they have an option in the Add-Remove Programs in the Control Panel, uninstall them if you can.

C:\Program Files\WinAntiVirus Pro 2006, FWSvc.exe is a part of WinAntiVirus, which hijacks your desktop and displays false messages that your computer is being infected with spyware and virus.

DriveCleaner is a security assesment tool which gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks.

C:\Program Files\BearShare Spyware comes with it , uninstall it.
C:\Program Files\SpamBlockerUtility <– Bogus program
C:\Program Files\DriveCleaner 2006 Free<– Bogus program
C:\Program Files\WinAntiVirus Pro 2006<– Bogus program

Download and install the 30 day trial of Ewido Anti-Spyware from HERE and save that file to your desktop.

* Once you have downloaded Ewido Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
* Once the setup is complete you will need run Ewido and update the definition files.
* On the main screen select the icon Update then select the Update now link.
* Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
* Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
* Once in the Settings screen click on Recommended actions and then select Quarantine
* Under Reports
* Select Automatically generate report after every scan
* Un-Select Only if threats were found
* Close Ewido Anti-Spyware <– Do not run the scan yet.

* Go to Start> Run and type in services.msc then press Enter
* Scroll down to Firewall service
* Double Click that service to open it.
* Click on Stop Service.
* Then change the Startup Type to Disabled.
* OK your way out of the program.

Open HJT > Misc Tools > Delete an NT Service
* Type in FWSvc
* Then click on OK, it will ask you to reboot, do so.

Open HJT Scan Only, close your browser and all open windows, check these and click on Fix Checked.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/…://my.yahoo.com

R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)

O4 - HKLM\..\Run: [SpamBlocker] C:\Program Files\SpamBlockerUtility\Bin\4.6.1.0\SbOEAddOn.exe
O4 - HKLM\..\Run: [Spam Blocker for Outlook Express] C:\PROGRA~1\SPAMBL~1\Bin\461~1.0\SBInst.exe
O4 - HKLM\..\Run: [a77g9cc5] C:\WINNT\system32\a77g9cc5.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [pumd] c:\winnt\system32\pumd.exe /nocomm
O4 - HKLM\..\Run: [CPZHRNX] C:\WINNT\CPZHRNX.exe
O4 - HKLM\..\Run: [SYFMSZC] C:\WINNT\SYFMSZC.exe
O4 - HKLM\..\Run: [Build new corn trans] C:\Documents and Settings\All Users\Application Data\flawskipbuildnew\DRAWPHONE.exe
O4 - HKLM\..\Run: [gdimx] c:\winnt\system32\gdimx.exe /nocomm
O4 - HKLM\..\Run: [DriveCleaner 2006 Free] "C:\Program Files\DriveCleaner 2006 Free\UDC2006.exe" /min
O4 - HKLM\..\RunServices: [Windows Recycler] damlmyx.exe
O4 - HKLM\..\Run: [mplay64] c:\program files\common files\system\mplay64.exe /noerrorinfo
O4 - Global Startup: palstart.exe

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

O23 - Service: Firewall service (FWSvc) - Unknown owner - C:\Program Files\WinAntiVirus Pro 2006\FWSvc.exe (file missing)

Boot your computer into Safemode

* Go to Start> Shut Off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to SAFEMODE
* Then press the Enter on your Keyboard

IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:

* Lauch Ewido-Anti-Spyware by double-clicking the icon on your desktop.
* Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
* Ewido will now begin the scanning process, be patient this may take a little time.
* Once the scan is complete do the following:
* If you have any infections you will prompted, then select Apply all actions
* Next select the Reports icon at the top.
* Select the Save report as button in the lower left hand of the screen and save it to a text file on your system.
*** make sure to remember where you saved that file, this is important
* Close Ewido

Still in Safemode, right click on Start and then click on Explore and Navigate to the following files and folders and delete them.

C:\Program Files\BearShare
C:\Program Files\SpamBlockerUtility
C:\Program Files\DriveCleaner 2006 Free
C:\Program Files\WinAntiVirus Pro 2006

C:\WINNT\CPZHRNX.exe
C:\WINNT\SYFMSZC.exe

C:\program files\common files\system\mplay64.exe
C:\WINNT\system32\a77g9cc5.exe
C:\winnt\system32\damlmyx.exe
C:\winnt\system32\pumd.exe
C:\winnt\system32\gdimx.exe

C:\Documents and Settings\All Users\Application Data\flawskipbuildnew\DRAWPHONE.exe

Reboot normally and lets run a system cleaner to get into all the nooks and cranies.

Installing this program will by default install the Yahoo Toolbar. You can remove the Yahoo Toolbar if you wish via the Add-Remove Programs in the Control Panel.
Download and Install CCleaner
* Click on Run Cleaner
Tutorial for CCleaner

I need to see the log from Ewido and a new HJT log.

bns2000

Post #3August 5, 2006, 10:09 AM UTC

——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 4:05:12 AM 8/5/2006 + Scan result: C:\Documents and Settings\Michael & Ricky\Local Settings\Temp\resBC.tmp -> Adware.180Solutions : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\ncmyb.SABHO -> Adware.180Solutions : Error during cleaning. HKLM\SOFTWARE\Classes\ncmyb.SABHO.1 -> Adware.180Solutions : Error during cleaning. HKLM\SOFTWARE\Classes\ncmyb.SABHO\CLSID -> Adware.180Solutions : Error during cleaning. HKLM\SOFTWARE\Classes\ncmyb.SABHO\CurVer -> Adware.180Solutions : Error during cleaning. C:\Documents and Settings\Mom\Local Settings\Temp\__unin__.exe -> Adware.Altnet : Cleaned with backup (quarantined). C:\WINNT\system32\BO2802040113.dll -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\WINNT\dsr.dll -> Adware.BetterInternet : Cleaned with backup (quarantined). C:\WINNT\lfcgaeprhml.exe -> Adware.BetterInternet : Cleaned with backup (quarantined). C:\WINNT\casino.exe -> Adware.Casino : Cleaned with backup (quarantined). C:\WINNT\casinoc.exe -> Adware.Casino : Cleaned with backup (quarantined). C:\WINNT\vegas.exe -> Adware.Casino : Cleaned with backup (quarantined). C:\WINNT\sideb.exe -> Adware.EliteBar : Cleaned with backup (quarantined). C:\WINNT\system32\shawn_1.dll -> Adware.EliteBar : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\TTIL_SBC.exe -> Adware.EZula : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Local Settings\Temp\THI4E35.tmp\WSEbate1.exe -> Adware.HelpExpress : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\THI775E.tmp\WSEbate1.exe -> Adware.HelpExpress : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\Config.xml -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\dwld -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\dwld\WhiteList.xip -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\persist.dbs -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\report -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\report\ag.xml -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\report\ag.xml.db -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\report\send.xml -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\report\send.xml.db -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\res1 -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\cs\res1\WhiteList.dbs -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\ShopperReports\shprrprt.log -> Adware.HotBar : Cleaned with backup (quarantined). C:\Program Files\SpamBlockerUtility\Bin\4.6.1.0\Contact.dll -> Adware.HotBar : Cleaned with backup (quarantined). C:\Program Files\SpamBlockerUtility\Bin\4.6.1.0\SbGuard.exe -> Adware.HotBar : Cleaned with backup (quarantined). C:\Program Files\SpamBlockerUtility\Bin\4.6.1.0\SbOEAddOn.exe -> Adware.Hotbar : Cleaned with backup (quarantined). C:\Program Files\SpamBlockerUtility\Bin\4.6.1.0\SbWallpaper.dll -> Adware.HotBar : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\Contact.Contacts -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\Contact.Contacts.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\HbCoreSrv.DynamicProp -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\HbCoreSrv.DynamicProp.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\HbCoreSrv.DynamicProp\CLSID -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\HbCoreSrv.DynamicProp\CurVer -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\HbHostOL.HbElementFocus -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\HbHostOL.HbElementFocus.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\HbHostOL.HbElementFocus\CLSID -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\HbHostOL.HbElementFocus\CurVer -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\RprtsPSClient.PSExecuter -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\RprtsPSClient.PSExecuter.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\RprtsPSClient.PSExecuter\CLSID -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\RprtsPSClient.PSExecuter\CurVer -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbAx -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbAx.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbAx\CLSID -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbAx\CurVer -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbCommBand -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbCommBand.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbInfoBand -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbInfoBand.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbInfoBand\CLSID -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.HbInfoBand\CurVer -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.IEButton -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.IEButton.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.IEButtonA -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.IEButtonA.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.IEButtonA\CLSID -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.IEButtonA\CurVer -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.IEButton\CLSID -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.IEButton\CurVer -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.SmrtShprCtl -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.SmrtShprCtl.1 -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.SmrtShprCtl\CLSID -> Adware.HotBar : Error during cleaning. HKLM\SOFTWARE\Classes\ShprRprts.SmrtShprCtl\CurVer -> Adware.HotBar : Error during cleaning. C:\Documents and Settings\Daddy\Local Settings\Temp\bar.exe -> Adware.IeSearchBar : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Local Settings\Temp\bar.exe -> Adware.IeSearchBar : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\upd120.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\Program Files\Adverts\uninst.exe -> Adware.Lop : Cleaned with backup (quarantined). C:\Program Files\Support Software\SS2.DLL -> Adware.MediaPops : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\DyFuCA_BH.BHObj -> Adware.MoneyTree : Error during cleaning. HKLM\SOFTWARE\Classes\DyFuCA_BH.BHObj.1 -> Adware.MoneyTree : Error during cleaning. HKLM\SOFTWARE\Classes\DyFuCA_BH.BHObj\CLSID -> Adware.MoneyTree : Error during cleaning. HKLM\SOFTWARE\Classes\DyFuCA_BH.BHObj\CurVer -> Adware.MoneyTree : Error during cleaning. C:\WINNT\NDNuninstall5_48.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINNT\NDNuninstall5_64.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINNT\NDNuninstall6_10.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINNT\NDNuninstall6_22.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Start Menu\Programs\Power Scan -> Adware.PowerScan : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Start Menu\Programs\Power Scan\Power Scan.lnk -> Adware.PowerScan : Cleaned with backup (quarantined). C:\Program Files\SearchRelevant\SearchRelevant.dll -> Adware.Relevance : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\SAVE-Cm-Sm-Tb.exe/Save.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\SAVE-Cm-Sm-Tb.exe/SaveUninst.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\SAVE-Cm-Sm-Tb.exe/Search.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\SAVE-Cm-Sm-Tb.exe/Sync.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\SAVE-Cm-Sm-Tb.exe/Uninst.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\SAVE-Cm-Sm-Tb.exe/Weather.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\4scenicwu.exe/VVSN.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Start Menu\Programs\WhenU -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Start Menu\Programs\WhenU\Learn More About WhenU Save.url -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Start Menu\Programs\WhenU\Learn More About WhenU SaveNow.url -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Start Menu\Programs\WhenU\Uninstall.lnk -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Start Menu\Programs\WhenU\WhenU Help Desk.lnk -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Start Menu\Programs\WhenU\WhenU.com Website.url -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\nst30.EXE -> Adware.SmartPops : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\nst241.EXE -> Adware.SmartPops : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\BrowserSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\BrowserSearch\BrowserSearch.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\BrowserSearch\BrowserSearch.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ErrorSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Layouts -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Layouts\PreferencesLayout.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Layouts\PreferencesLayout.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Layouts\ToolbarLayout.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Layouts\ToolbarLayout.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Layouts\WeatherLayout.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Layouts\WeatherLayout.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Manager -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Manager\ManagerOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Manager\ManagerOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\PopupBlocker -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\PopupBlocker\PopupBlockerOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\PopupBlocker\PopupBlockerOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Reference -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Reference\ReferenceOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Reference\ReferenceOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\RelatedSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Screensavers -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Screensavers\ScreensaversOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Screensavers\ScreensaversOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\SearchMatch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\SearchMatch\SearchMatchOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\SearchMatch\SearchMatchOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Toolbar -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ToolbarLogo -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ToolbarSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Toolbar\TBProductsOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Toolbar\TBProductsOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\TravelSearch -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\TravelSearch\TravelSearchOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\TravelSearch\TravelSearchOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Weather -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Weather\AlertArchive.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Weather\AlertArchive.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Weather\WeatherOptions.xml -> Adware.Starware : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Application Data\Starware\Weather\WeatherOptions.xml.backup -> Adware.Starware : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\AppID\{4F5E5D72-C915-4f3b-908B-527D064B0FAA} -> Adware.SysProtect : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\Interface\{02946FD1-2D99-46E6-A790-3A089714EDD9} -> Adware.SysProtect : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Start Menu\Programs\ClockSync -> Adware.WhenU : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Start Menu\Programs\ClockSync\ClockSync.lnk -> Adware.WhenU : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Start Menu\Programs\WhenUSearch -> Adware.WhenU : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Start Menu\Programs\WhenUSearch\WhenUSearch Desktop Toolbar.lnk -> Adware.WhenU : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Start Menu\Programs\WhenUSearch -> Adware.WhenU : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Start Menu\Programs\WhenUSearch\WhenUSearch Desktop Toolbar.lnk -> Adware.WhenU : Cleaned with backup (quarantined). C:\temp\Remover.exe -> Adware.Winad : Cleaned with backup (quarantined). HKU\S-1-5-21-2832471526-3054548624-236718858-1035\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178F3FB-2560-458F-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Cleaned with backup (quarantined). C:\Program Files\Windows TaskAd -> Adware.WinTaskAd : Cleaned with backup (quarantined). C:\Program Files\Common Files\ioki\iokip.exe -> Adware.Xupiter : Cleaned with backup (quarantined). C:\WINNT\cheatspur[chp-10158,de,1].exe -> Dialer.Star : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_3D4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_590.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_734.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_844.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_8A8.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_91C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_9B4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_A6C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_A8C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_BB4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_D00.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Local Settings\Temp\lf_1594.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Local Settings\Temp\lf_16C0.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Local Settings\Temporary Internet Files\Content.IE5\OXERWPI7\mplay64[1].exe -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\lf_106C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\lf_1484.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\lf_900.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\lf_C5C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\lf_C7C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\sup\Local Settings\Temporary Internet Files\Content.IE5\EUDELAHI\mplay64[1].exe -> Downloader.Agent.wp : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\qdelwbi.tmp -> Downloader.Dluca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_128.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_161C.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_244.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_864.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_92C.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_950.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_AA8.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_ADC.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\lf_DA4.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\lf_1490.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\lf_CA4.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\lf_FEC.tmp -> Downloader.Dluca.ca : Cleaned with backup (quarantined). C:\WINNT\Downloaded Program Files\QDow.dll -> Downloader.QDown.d : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\My Documents\My Received Files\Messenger Plus! - Setup.exe/Sponsor.exe -> Downloader.Swizzor.bt : Cleaned with backup (quarantined). C:\WINNT\system32\sysdebug32.exe -> Hijacker.VB.dn : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Local Settings\Temporary Internet Files\Content.IE5\NIQ6AAEK\WinFixer2005ScannerInstall[1].exe -> Not-A-Virus.Downloader.Win32.Agent.d : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Local Settings\Temporary Internet Files\Content.IE5\OXERWPI7\WinFixer2005ScannerInstall[1].exe -> Not-A-Virus.Downloader.Win32.Agent.d : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Temporary Internet Files\Content.IE5\Y2RXT2ZF\WinFixer2005ScannerInstall[1].exe -> Not-A-Virus.Downloader.Win32.Agent.d : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\winantiviruspro2006freeinstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Local Settings\Temporary Internet Files\Content.IE5\7VL6QATL\WinAntiVirusPro2006FreeInstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@buycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@microsoftconsumermarketing.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@pch.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@wholesalemarketer.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@wrigley.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\daddy@buycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\daddy@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\system@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Cookies\nana@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@bulldog.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\daddy@aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@abetterinternet[1].txt -> TrackingCookie.Abetterinternet : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & ricky@abetterinternet[2].txt -> TrackingCookie.Abetterinternet : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Cookies\[removed][2].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@bestoffersnetworks[1].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\daddy@bestoffersnetworks[1].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & ricky@bestoffersnetworks[1].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Local Settings\Temp\Cookies\michael & ricky@bestoffersnetworks[1].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@cliks[3].txt -> TrackingCookie.Cliks : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\daddy@cliks[1].txt -> TrackingCookie.Cliks : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & ricky@cliks[2].txt -> TrackingCookie.Cliks : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Local Settings\Temp\Cookies\michael & ricky@cliks[1].txt -> TrackingCookie.Cliks : Cleaned with backup (quarantined). :mozilla.13:C:\Documents and Settings\sup\Application Data\Mozilla\Firefox\Profiles\3nvxzzcz.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\Earthlink\6.0\[removed]\Cookies\mom@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & ricky@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\Earthlink\6.0\[removed]\Cookies\mom@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Cookies\nana@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Epilot : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Local Settings\Temp\Cookies\michael & [removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\Earthlink\6.0\[removed]\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@goldenpalace[1].txt -> TrackingCookie.Goldenpalace : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@goldenpalace[2].txt -> TrackingCookie.Goldenpalace : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][1].txt -> TrackingCookie.Realcastmedia : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\Earthlink\6.0\[removed]\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\Earthlink\6.0\[removed]\Cookies\mom@starware[2].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined). :mozilla.23:C:\Documents and Settings\sup\Application Data\Mozilla\Firefox\Profiles\3nvxzzcz.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\WINNT\system32\config\systemprofile\Cookies\system@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & ricky@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Cookies\nana@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\[removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Cookies\daddy@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Daddy\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Cookies\michael & [removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Michael & Ricky\Local Settings\Temp\Cookies\michael & [removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\Earthlink\6.0\[removed]\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Mom\Application Data\Earthlink\6.0\[removed]\Cookies\mom@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Cookies\[removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\[removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\Cookies\nana@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\WINNT\system32\config\systemprofile\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\WINNT\system32\config\systemprofile\Cookies\system@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\X08PLMBF\proxy_inst[1].exe -> Trojan.EliteBar.a : Cleaned with backup (quarantined). C:\WINNT\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\UFI18V87\proxy_inst[1].exe -> Trojan.EliteBar.a : Cleaned with backup (quarantined). C:\Documents and Settings\Nana\Local Settings\Temp\1575530_18780_1064_17796_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined). C:\WINNT\aac.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined). C:\WINNT\dslife.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined). C:\WINNT\exactoffernew.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined). C:\WINNT\invupd.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined). C:\WINNT\msbbi.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined). C:\WINNT\nexus.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined). C:\WINNT\nexus8.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined). C:\WINNT\zgbinvite.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined). ::Report end

bns2000

Post #4August 5, 2006, 10:10 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 5:04:24 AM, on 8/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\slserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINNT\system32\rundll32.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://59.148.220.121/trafc-2.1/rfe.php?cm…tes2&nid=go
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LaunchPDeviceConn] "C:\Program Files\Philips\Philips Device Transfer Pop-up\PDeviceConn.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

ken545

Post #5August 5, 2006, 12:47 PM UTC last edited August 5, 2006, 6:52 PM UTC

bns2000, you had a ton of bad stuff installed. Open Ewido and go to the Qurarantine folder and delete it all, nothing in there you want to keep on your system. How are things running now???

ken545

Post #6August 5, 2006, 6:51 PM UTC

bns2000,

Lets do one more quick manuver before we deem your system clean.

Open HJT , right click on the HJT Icon [external image: Posted Image] and click on Rename and rename it to Analyze.exe. Then run another HJT scan and post a new log.

ken545

Post #7August 17, 2006, 2:06 AM UTC

This topic is being closed due to lack of response, if you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

HjackThis log

✨ Ask AI

Ask AI