What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Baseline

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Any help is appreciated! This $hit is very frustrating – I have Windows Defender Beta 2 and Trend Micro PC-Cillin and both find and remove traces, but it continues to return. I have resorted to using Firefox in the meantime, but must use IE for personal reasons.

Logfile of HijackThis v1.99.1
Scan saved at 1:11:53 AM, on 8/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MoodLogic\Service\Updater.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\BUFFALO\Client Manager 2\ClientMgr2.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccVScan.exe
C:\WINDOWS\system32\smartdrv.exe
C:\WINDOWS\system32\officescan.exe
C:\Documents and Settings\Don Norton\Desktop\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: (no name) - {00000000-59D4-4008-9058-080011001200} - (no file)
O2 - BHO: (no name) - {00000000-C1EC-0345-6EC2-4D0300000000} - (no file)
O2 - BHO: (no name) - {00000000-F09C-02B4-6EC2-AD0300000000} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3ceff6cd-6f08-4e4d-bccd-ff7415288c3b} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: (no name) - {7b55bb05-0b4d-44fd-81a6-b136188f5deb} - (no file)
O2 - BHO: (no name) - {8333c319-0669-4893-a418-f56d9249fca6} - (no file)
O2 - BHO: (no name) - {9c691a33-7dda-4c2f-be4c-c176083f35cf} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll
O2 - BHO: (no name) - {e52dedbb-d168-4bdb-b229-c48160800e81} - (no file)
O2 - BHO: (no name) - {ffd2825e-0785-40c5-9a41-518f53a8261f} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Beoplayertray] C:\Program Files\Bang & Olufsen\BeoPort\Beotray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MoodLogic Updater] C:\Program Files\MoodLogic\Service\Updater.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adware.Srv32] C:\WINDOWS\system32\runsrv32.exe
O4 - HKLM\..\Run: [Transponder] C:\WINDOWS\system32\susp.exe
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BeoPort.lnk = C:\Program Files\Bang & Olufsen\BeoPort\BeoPlayer.exe
O4 - Global Startup: ClientManager2.lnk = C:\Program Files\BUFFALO\Client Manager 2\ClientMgr2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1142881643000
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Post #3
But Windows Defender keeps popping up, letting me know the antispyware.net site is still trying to hijack my homepage – I keep 'blocking' it.
Post #4
Hello and welcome to the forum.

This is what I suggest you do.


Please do not delete anything unless instructed to.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.




Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
– Click the Gear wheel at the top of the Ad-Aware window
– Click General > Safety & Settings: Check (Green) all three.
– Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Next:

download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded ewido anti-spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition
    files.
  • On the main screen select the icon "Update" then select the "
    Update now    " link.
    • Next select the "Start Update" button, the update will start and a
      progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select ""Delete".".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting
    your computer and continually tapping the F8 key until a menu appears.

    Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or
    programs while ewido is scanning, it may interfere with the scanning proccess:
  • Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little
    time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all
    actions    "
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the
    screen and save it to a text file on your system (make sure to remember where
    you saved that file, this is important).
  • Close ewido and reboot your system back into Normal Mode and post the
    results of the ewido report scan along with a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #5
Here are the latest logs – the computer seems to be running better, but please let me know if the scans missed anything. THANKS SO MUCH FOR YOUR HELP!

Don

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 5:02:29 PM 8/8/2006

+ Scan result:



HKLM\SOFTWARE\Alexa Internet -> Adware.Alexa : No action taken.
HKLM\SOFTWARE\Classes\AlxTB.BHO -> Adware.Alexa : No action taken.
HKLM\SOFTWARE\Classes\PopMenu.Menu -> Adware.Alexa : No action taken.
HKLM\SOFTWARE\Classes\Popup.PopupKiller -> Adware.Alexa : No action taken.
HKLM\SOFTWARE\Classes\Bridge.brdg -> Adware.BlazeFind : No action taken.
HKLM\SOFTWARE\Classes\jao.jao -> Adware.BlazeFind : No action taken.
HKLM\SOFTWARE\Classes\AppID\DailyToolbar.DLL -> Adware.DailyToolbar : No action taken.
HKLM\SOFTWARE\Classes\DailyToolbar.IEBand -> Adware.DailyToolbar : No action taken.
HKLM\SOFTWARE\Classes\DailyToolbar.SysMgr -> Adware.DailyToolbar : No action taken.
HKLM\SOFTWARE\Classes\IEToolbar.AffiliateCtl -> Adware.DailyToolbar : No action taken.
HKLM\SOFTWARE\DailyToolbar -> Adware.DailyToolbar : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{B53455DB-5527-4041-AC41-F86E6947AA47} -> Adware.Generic : No action taken.
HKLM\SOFTWARE\Classes\Interface\{900FBC20-6AEE-4E05-ABA9-AC46E309C029} -> Adware.Generic : No action taken.
HKLM\SOFTWARE\Classes\TypeLib\{8B076501-1D1B-4B26-9492-FDB8EEE00D7F} -> Adware.Generic : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B53455DB-5527-4041-AC41-F86E6947AA47} -> Adware.Generic : No action taken.
HKU\S-1-5-21-32705639-4108795224-3088936939-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B53455DB-5527-4041-AC41-F86E6947AA47} -> Adware.Generic : No action taken.
HKLM\SOFTWARE\RespondMiter -> Adware.VX2 : No action taken.
C:\WINDOWS\system32\utqrjgjn.exe -> Downloader.VB.ajp : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{E52DEDBB-D168-4BDB-B229-C48160800E81} -> Hijacker.Generic : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e52dedbb-d168-4bdb-b229-c48160800e81} -> Hijacker.Generic : No action taken.
HKU\S-1-5-21-32705639-4108795224-3088936939-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E52DEDBB-D168-4BDB-B229-C48160800E81} -> Hijacker.Generic : No action taken.
C:\WINDOWS\system32\lbdiozpa.cvt -> Hijacker.Small.js : No action taken.
C:\WINDOWS\system32\office_pnl.dll -> Not-A-Virus.Hoax.Win32.Renos.dm : No action taken.
:mozilla.80:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.81:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.83:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.84:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.85:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Guest\Cookies\guest@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
:mozilla.269:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.270:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.271:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.272:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.273:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.137:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.138:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.71:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.72:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.73:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.74:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.75:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.47:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Don Norton\Cookies\don norton@com[1].txt -> TrackingCookie.Com : No action taken.
:mozilla.263:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Cqcounter : No action taken.
:mozilla.43:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.123:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.124:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.125:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.126:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.235:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.236:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.237:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.64:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.65:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.66:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.67:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.68:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.69:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.158:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.159:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.160:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.161:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.6:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.7:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.8:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.9:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
C:\Documents and Settings\Guest\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.260:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Masterstats : No action taken.
:mozilla.139:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.22:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.26:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.27:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.258:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Paycounter : No action taken.
:mozilla.112:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.115:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.116:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.117:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.100:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.96:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.98:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.99:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.174:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.175:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.176:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.177:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.178:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.179:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.180:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.181:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.182:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.183:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.184:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.185:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.186:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.187:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.188:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.189:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.190:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.191:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.192:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.193:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.194:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.195:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.196:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.197:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.198:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.199:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.200:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.201:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.202:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.203:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.204:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.205:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.206:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.207:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.208:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.209:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.210:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.211:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.212:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.213:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.214:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.215:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.228:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexlist : No action taken.
:mozilla.229:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexlist : No action taken.
:mozilla.230:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sexlist : No action taken.
:mozilla.231:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sextracker : No action taken.
:mozilla.232:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Sextracker : No action taken.
:mozilla.292:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.103:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.104:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.105:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.106:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
C:\Documents and Settings\Guest\Cookies\guest@tacoda[1].txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.274:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.275:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.150:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
C:\Documents and Settings\Guest\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.299:C:\Documents and Settings\Don Norton\Application Data\Mozilla\Firefox\Profiles\xpp30g6l.default\cookies.txt -> TrackingCookie.Zedo : No action taken.


::Report end






Logfile of HijackThis v1.99.1
Scan saved at 5:22:31 PM, on 8/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\AcroTray.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\MoodLogic\Service\Updater.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\BUFFALO\Client Manager 2\ClientMgr2.exe
C:\Documents and Settings\Don Norton\Desktop\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Beoplayertray] C:\Program Files\Bang & Olufsen\BeoPort\Beotray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MoodLogic Updater] C:\Program Files\MoodLogic\Service\Updater.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BeoPort.lnk = C:\Program Files\Bang & Olufsen\BeoPort\BeoPlayer.exe
O4 - Global Startup: ClientManager2.lnk = C:\Program Files\BUFFALO\Client Manager 2\ClientMgr2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1142881643000
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe




Spybot Post-Startup

BlazeFind.Bridge: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{4FDBDBAD-FEFE-4C4C-9CC1-1181052AFB12}
BlazeFind.Bridge: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9C691A33-7DDA-4C2F-BE4C-C176083F35CF}
DailyToolbar: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{58F9B276-E1CC-458E-8159-21CBC021874B}
DailyToolbar: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{8333C319-0669-4893-A418-F56D9249FCA6}
ABetterInternet: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-C1EC-0345-6EC2-4D0300000000}
Smitfraud-C.: Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-32705639-4108795224-3088936939-1005\Software\Microsoft\IPCheck
Smitfraud-C.: Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-32705639-4108795224-3088936939-1005\Software\Microsoft\Windows\CurrentVersion\RunOnce\Srv32 spool service
Smitfraud-C.: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{60e2e76b-60e2e76b-60e2e76b-60e2e76b-60e2e76b}
Smitfraud-C.: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{10195311-E434-47A9-ADBA-48839E3F7E4E}
Smitfraud-C.: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{A6A68CBD-6673-41B1-B997-3F83A25B45B0}
Smitfraud-C.: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{ABAFA0B4-F78D-42E5-8C31-1A441D01C1DF}
Smitfraud-C.: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{B71C7D9A-DA43-4E8B-BB98-1684AC2AF324}
Smitfraud-C.: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ceff6cd-6f08-4e4d-bccd-ff7415288c3b}
Smitfraud-C.: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7b55bb05-0b4d-44fd-81a6-b136188f5deb}
Smitfraud-C.: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Srv32 spool service
Smitfraud-C.: Autorun settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Transponder
Smitfraud-C.: Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Popup.HTMLEvent.
Smitfraud-C.: Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\url_relpacer.URLResolver
Smitfraud-C.: Picture (File, nothing done)
C:\WINDOWS\win_logo.gif
Alexa: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{3E60160F-0ED6-4DCC-B6B6-850CDE4FD217}
Alexa: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{0BBB0424-E98E-4405-9A94-481854765C80}
Alexa: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{0F3332B5-BC98-48AF-9FAC-05FEC94EBE73}
Alexa: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{A69107CC-BEC8-4A34-B474-211B0F46A764}
Alexa: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{FA77AD79-09CF-41FB-B171-CC856F9E737F}
Alexa: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{B7B84995-8B92-46BF-94AA-FA2F3DD23B84}
Alexa: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Alexa Toolbar
Alexa: Type library (Registry key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{547AB549-4DD8-4ea0-B070-F6EA062148FF}
Alexa: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alexa Toolbar
Statblaster.All files7: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{80BB7465-A638-43B5-9827-8E8FE38DFCC1}
Statblaster.All files7: Type library (Registry key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{C094876D-1B0E-46FA-B6A6-7FFC0F970C27}
Statblaster.All files7: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bridge
VX2.b.BDS: Global settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Transponder
VX2.g.SiteHlpr: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FFD2825E-0785-40C5-9A41-518F53A8261F}
SpywareSheriff.FakeAlert: Autorun settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adware.Srv32
SpywareSheriff.FakeAlert: Program file (File, nothing done)
C:\WINDOWS\system32\runsrv32.exe
SpywareSheriff.FakeAlert: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-59D4-4008-9058-080011001200}
SpywareSheriff.FakeAlert: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-F09C-02B4-6EC2-AD0300000000}
SpywareSheriff.FakeAlert: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8333c319-0669-4893-a418-f56d9249fca6}
SpywareSheriff.FakeAlert: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Software\TPS108
SpywareSheriff.FakeAlert: Settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Transponder\Adware.Srv32
— Spybot - Search & Destroy version: 1.4 (build: 20050523) —
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2006-08-08 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-08-04 Includes\Cookies.sbi (*)
2006-08-04 Includes\Dialer.sbi (*)
2006-08-04 Includes\Hijackers.sbi (*)
2006-08-04 Includes\Keyloggers.sbi (*)
2006-08-04 Includes\Malware.sbi (*)
2006-08-04 Includes\PUPS.sbi (*)
2006-08-04 Includes\Revision.sbi (*)
2006-08-04 Includes\Security.sbi (*)
2006-08-04 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-08-04 Includes\Trojans.sbi (*)
Post #6
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

Close ALL windows and browsers except HijackThis and click "Fix checked"




Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #7
Logfile of HijackThis v1.99.1
Scan saved at 8:37:32 PM, on 8/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MoodLogic\Service\Updater.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\BUFFALO\Client Manager 2\ClientMgr2.exe
C:\Documents and Settings\Don Norton\Desktop\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Beoplayertray] C:\Program Files\Bang & Olufsen\BeoPort\Beotray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MoodLogic Updater] C:\Program Files\MoodLogic\Service\Updater.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BeoPort.lnk = C:\Program Files\Bang & Olufsen\BeoPort\BeoPlayer.exe
O4 - Global Startup: ClientManager2.lnk = C:\Program Files\BUFFALO\Client Manager 2\ClientMgr2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1142881643000
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Post #9
Things seem to be going just fine. Which of the spyware programs I used to help 'clean' is best for preventing new infections – I'd like to buy one to prevent it from happening again! Thanks again for your help.
Post #10
There are Free programs listed below.

Good Job :thumbup:

Log looks good :D


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.





If you dont have these programs I would recommend that you get them. Spywareblaster, Spywareguard. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein
Post #11
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI