Spyware / Malware / Virus Removal

Downloader/Infostealer Help please

9 min read

Looking for the outcome? Ask AI

Deleted Member Topic Starter

Post #1August 21, 2006, 8:08 PM UTC

NAV picked up Downloader virus about a week ago. Keep thinking my system is clean, but it is not. NAV also catching Infostealer virus periodically. Have followed Norton/Symantec's instructions to no avail. Every day or two it seems to return. Scan in Safe Mode and neither NAV or Panda found any viruses. Also use AdAware, and Spybot. Started using Autoruns when Downloader was discovered and have deleted harmful files when found. Here's my HijackThis log. I see two entries for mssyc20.exe which I know I have deleted a few times before, and I suspect I need to "fix" within HijackThis. Hoping to get your expert guidance before I do this and for input on anything else that looks suspect in the log. Thanks much for any help you can provide.

Logfile of HijackThis v1.99.1
Scan saved at 2:39:45 PM, on 8/21/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\Norton\Navnt\navapsvc.exe
C:\PROGRA~1\Norton\Navnt\npssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Norton\Navnt\alertsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton\Navnt\navapw32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Documents and Settings\Greg\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cyclonecorvette.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://sidesearch.dropspam.com/sidesearch.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Norton\Navnt\npscheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\RunServices: [mssync20] C:\WINDOWS\System32\mssync20.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\RunServices: [mssync20] C:\WINDOWS\System32\mssync20.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Norton\Navnt\navapw32.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…arch.jhtml?p=ZN
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B6E649FA-5461-40d7-AB4D-54FC3C8DB767} - C:\Program Files\DropSpam\ewwie.dll (file missing)
O9 - Extra 'Tools' menuitem: Looksitup Toolbar - {B6E649FA-5461-40d7-AB4D-54FC3C8DB767} - C:\Program Files\DropSpam\ewwie.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.principal.com/ica32t.exe
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsr.cab
O16 - DPF: {5EB6A98B-F75B-4AC7-821D-BAD2C29D18C2} (CVALAXObj Class) - https://autoins1.progressivedirect.com/ptt/cv/CVALAX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106978890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106962937
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neutral/co….cab?10,0,910,0
O20 - AppInit_DLLs: C:\WINDOWS\System32\win_i2.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NAV Alert - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\navapsvc.exe
O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\npssvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe

Susan528

Post #2August 21, 2006, 8:51 PM UTC

Hello Retire_Early and Welcome to TomCoyote,

Please do the following:

Download Gmer from here:
http://www.gmer.net/gmer.zip

Disconnect from internet and close running programs.
There is a small chance this app may crash your computer so save any work you have open.
Double click gmer.exe
Let the gmer.sys driver load if asked.
If it gives you a warning at program start about rootkit activity and asks if you want to run scan…say Ok.
If no warning….
Click "rootkit" tab and click "scan"
Once done click "copy"
Open Notepad and hit "ctrl+v" to paste log.
Reconnect to internet and post log please.

==========================
Download, unzip and run 'RootkitRevealer' from Sysinternals:
http://www.sysinternals.com/Utilities/RootkitRevealer.html

Once the program has started, press Scan and let it run.
When the scan is done, use 'File > Save' to place the logfile in a convenient location (such as the desktop). The default filename will be 'RootkitReveal.txt'.

Save your Log File
Copy/Paste the contents of that logfile into your next reply

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !
==========================
On your next reply, please include:

A Fresh Hijackthis log
gmer log
rootkitrevealer log

Deleted Member

Post #3August 21, 2006, 9:56 PM UTC

Susan528 - Thanks much for helping. I have to confess that I checked the two mssync20.exe with HJT before I got your reply. Now that I have your expert guidance, I won't take any steps without your direction. Here are the results…

Logfile of HijackThis v1.99.1
Scan saved at 4:39:36 PM, on 8/21/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\Norton\Navnt\navapsvc.exe
C:\PROGRA~1\Norton\Navnt\npssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Norton\Navnt\alertsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton\Navnt\navapw32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cyclonecorvette.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://sidesearch.dropspam.com/sidesearch.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Norton\Navnt\npscheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Norton\Navnt\navapw32.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…arch.jhtml?p=ZN
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B6E649FA-5461-40d7-AB4D-54FC3C8DB767} - C:\Program Files\DropSpam\ewwie.dll (file missing)
O9 - Extra 'Tools' menuitem: Looksitup Toolbar - {B6E649FA-5461-40d7-AB4D-54FC3C8DB767} - C:\Program Files\DropSpam\ewwie.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.principal.com/ica32t.exe
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsr.cab
O16 - DPF: {5EB6A98B-F75B-4AC7-821D-BAD2C29D18C2} (CVALAXObj Class) - https://autoins1.progressivedirect.com/ptt/cv/CVALAX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106978890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106962937
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neutral/co….cab?10,0,910,0
O20 - AppInit_DLLs: C:\WINDOWS\System32\win_i2.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NAV Alert - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\navapsvc.exe
O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\npssvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe

GMER 1.0.10.10122 - http://www.gmer.net
Rootkit 2006-08-21 16:13:07
Windows 5.1.2600 Service Pack 1

—- System - GMER 1.0.10 —-

SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwAllocateVirtualMemory
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwCreateThread
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwMapViewOfSection
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwProtectVirtualMemory
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwShutdownSystem
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwTerminateProcess
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwWriteVirtualMemory

—- Devices - GMER 1.0.10 —-

Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F8AC5220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSEIRP_MJ_READ [F8AC5480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F8AC55A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [F8AC55D0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F8AC5220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSEIRP_MJ_READ [F8AC5480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F8AC55A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [F8AC55D0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F8AC5220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSEIRP_MJ_READ [F8AC5480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F8AC55A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [F8AC55D0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F8AC5220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSEIRP_MJ_READ [F8AC5480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F8AC55A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [F8AC55D0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [F8AC5220] wpsdrvnt.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSEIRP_MJ_READ [F8AC5480] wpsdrvnt.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F8AC55A0] wpsdrvnt.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SHUTDOWN [F8AC55D0] wpsdrvnt.sys

—- EOF - GMER 1.0.10 —-

Rootkit Revealer Scan Results:

C:\WINDOWS\Prefetch\322756[1].EXE-2C90879F.pf 8/16/2006 1:30 PM 16.39 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\ACRORD32.EXE-1CE22EA3.pf 8/19/2006 11:45 AM 92.94 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\ACRORD32INFO.EXE-10255AA7.pf 8/21/2006 12:03 PM 51.49 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\ACW.EXE-09AE1C0F.pf 8/16/2006 1:30 PM 43.84 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\AD-AWARE.EXE-1853B83A.pf 8/21/2006 11:33 AM 36.84 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\ASUNINST.EXE-091C770E.pf 8/21/2006 3:12 PM 8.38 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\AUTOBASE.EXE-05CA097E.pf 8/20/2006 1:11 PM 14.32 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\AUTOPLAY.EXE-328AAB68.pf 8/20/2006 12:40 PM 10.99 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\AUTORUN.EXE-055703AF.pf 8/20/2006 1:11 PM 5.68 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\AUTORUNS.EXE-1CCA3BA6.pf 8/21/2006 9:12 AM 58.17 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\AUTORUNS.EXE-3757B29D.pf 8/19/2006 7:49 AM 54.79 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\A~NSISU_.EXE-0E62F65D.pf 8/21/2006 3:12 PM 45.17 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\BASEBALL.W32-1CAD014A.pf 8/20/2006 1:11 PM 13.14 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\CALC.EXE-02A5B4B1.pf 8/18/2006 8:43 AM 10.74 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\CONTROL.EXE-24FBF8B3.pf 8/16/2006 3:46 PM 15.09 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\CREATECD50.EXE-33EF75B4.pf 8/21/2006 10:21 AM 20.89 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\CSRSS.EXE-22452D1B.pf 8/20/2006 9:46 AM 100.37 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\DEFRAG.EXE-2858C7E2.pf 8/19/2006 12:09 PM 10.76 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\DFRGNTFS.EXE-38C3807C.pf 8/19/2006 12:09 PM 67.13 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\DLLHOST.EXE-10286566.pf 8/16/2006 1:32 PM 21.12 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\DLLHOST.EXE-12C512CE.pf 8/16/2006 1:32 PM 24.01 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\DOWNLOADEXE.EXE-3183E8A5.pf 8/16/2006 1:30 PM 28.23 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\DRWTSN32.EXE-01DDCF15.pf 8/17/2006 7:29 PM 5.16 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\DUMPREP.EXE-0AF2BF67.pf 8/18/2006 2:21 PM 6.84 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\GLB1A2B.EXE-276FB0E0.pf 8/21/2006 3:14 PM 11.29 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\HELPSVC.EXE-1C192440.pf 8/20/2006 8:41 PM 69.98 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\HIJACKTHIS.EXE-21CD822E.pf 8/21/2006 2:38 PM 15.05 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\HPCMPMGR.EXE-0429AD9A.pf 8/21/2006 11:31 AM 28.96 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\HPWUCLI.EXE-0E22F180.pf 8/15/2006 10:53 AM 50.30 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\IKERNEL.EXE-182CAA81.pf 8/21/2006 3:11 PM 41.19 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\IPODSERVICE.EXE-37043579.pf 8/13/2006 1:36 PM 14.83 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\ISUNINST.EXE-2428235C.pf 8/21/2006 3:10 PM 19.12 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\ITUNESHELPER.EXE-0A1B0F2C.pf 8/13/2006 12:56 PM 14.73 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\LOAD[1].EXE-04BFCF05.pf 8/16/2006 1:35 PM 20.46 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\LOAD[1].EXE-366BA090.pf 8/19/2006 7:00 AM 21.12 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\LUALL.EXE-170845F0.pf 8/19/2006 7:54 AM 29.88 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\LUCOMS~1.EXE-1DF6F3E9.pf 8/19/2006 7:54 AM 42.72 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MAGIC3D.EXE-131F562C.pf 8/20/2006 12:40 PM 43.93 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MM_DIRECTOR.EXE-313DAB98.pf 8/21/2006 3:11 PM 8.85 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MM_TDMENGINE.EXE-09C92501.pf 8/21/2006 3:11 PM 17.67 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MMC.EXE-3AFB1C2E.pf 8/19/2006 8:33 AM 50.59 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MMC.EXE-6B42B488.pf 8/14/2006 7:50 PM 27.12 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MMDIAG.EXE-2CD118AB.pf 8/21/2006 3:11 PM 10.74 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MONEY EXPRESS.EXE-01809D84.pf 8/20/2006 9:03 PM 30.40 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MONITOR.EXE-3663B40D.pf 8/12/2006 4:20 PM 13.17 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MSDTC.EXE-1D9D8668.pf 8/16/2006 1:32 PM 17.85 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\MSIEXEC.EXE-330626DC.pf 8/21/2006 3:14 PM 64.79 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\NAVLU32.EXE-117D8891.pf 8/19/2006 7:54 AM 54.76 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\NOTEPAD.EXE-2F2D61E1.pf 8/21/2006 4:13 PM 12.93 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\NSCHEDNT.EXE-1FA0A864.pf 8/13/2006 2:45 PM 15.97 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\NTBACKUP.EXE-2A990C03.pf 8/16/2006 1:31 PM 25.08 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\NTVDM.EXE-0A81AB7B.pf 8/20/2006 1:11 PM 30.24 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\OSA.EXE-167137A9.pf 8/19/2006 8:01 PM 15.64 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\PALM.EXE-02A399C2.pf 8/13/2006 8:19 PM 64.39 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\POWERREG SCHEDULER V3.EXE-01A82AA7.pf 8/19/2006 7:17 AM 7.02 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\QCONSOLE.EXE-3441D429.pf 8/21/2006 9:11 AM 97.65 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\READER_SL.EXE-2FCCA463.pf 8/12/2006 4:20 PM 10.60 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\REGEDIT.EXE-2AE3423E.pf 8/21/2006 11:22 AM 47.60 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\REGSVR32.EXE-396DEA2C.pf 8/21/2006 3:11 PM 39.04 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RSMSINK.EXE-230A8CBD.pf 8/16/2006 1:32 PM 10.17 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RSTRUI.EXE-05C31B56.pf 8/16/2006 3:46 PM 54.11 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-2CA71ECE.pf 8/21/2006 3:11 PM 15.76 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-3B7994F9.pf 8/16/2006 3:46 PM 27.07 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-46976A17.pf 8/20/2006 1:09 PM 11.41 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4E87DEBC.pf 8/15/2006 10:55 AM 16.01 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4FF9832D.pf 8/21/2006 3:45 PM 8.90 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-5933E3BA.pf 8/21/2006 3:09 PM 100.23 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-67E85A51.pf 8/19/2006 7:36 AM 32.45 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-6E8D4657.pf 8/21/2006 10:21 AM 9.83 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-729D0AEB.pf 8/19/2006 11:15 AM 19.25 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\RUNONCE.EXE-01CA3A2F.pf 8/21/2006 9:51 AM 11.78 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\SET13A.TMP-07132094.pf 8/21/2006 3:11 PM 22.87 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\SETUP.EXE-393E66AE.pf 8/16/2006 1:29 PM 22.55 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\SETUP_WM.EXE-02751BCA.pf 8/18/2006 9:14 AM 27.15 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\SHELEXEC.EXE-34FD2DF1.pf 8/14/2006 8:41 PM 16.53 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\SNAPDETECT.EXE-204AFC37.pf 8/16/2006 1:24 PM 17.41 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\SPYBOTSD.EXE-1702AD5F.pf 8/19/2006 11:05 AM 67.31 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\STU_POKEMONSCREENSAVER_1.SCR-1DEE00AA.pf 8/19/2006 8:31 AM 30.78 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\STU_PO~1.SCR-0305A71C.pf 8/19/2006 8:07 AM 77.34 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\SYSOCMGR.EXE-07A918BD.pf 8/16/2006 1:25 PM 46.13 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\TASKMGR.EXE-06144C13.pf 8/13/2006 3:26 PM 15.24 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\UNINSTALL-YOHOHO.EXE-2C71A313.pf 8/21/2006 3:12 PM 11.84 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\UNINSTALL.EXE-1149CD12.pf 8/21/2006 3:10 PM 20.75 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\UNMATCH.EXE-207EEAD1.pf 8/21/2006 3:11 PM 12.90 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\UNWISE.EXE-21E7851A.pf 8/21/2006 3:11 PM 25.68 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\VSSVC.EXE-1F033002.pf 8/16/2006 1:32 PM 28.91 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\WFCRUN32.EXE-151B3D55.pf 8/21/2006 12:57 PM 23.06 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\WFICA32.EXE-255FB679.pf 8/21/2006 12:57 PM 26.92 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\WINLOGON.EXE-0957F9B2.pf 8/20/2006 9:46 AM 47.99 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\WINWORD.EXE-0614BEA2.pf 8/19/2006 9:52 AM 72.44 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-0D449B4F.pf 8/20/2006 8:41 PM 79.18 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\WMPLAYER.EXE-1ACCF80E.pf 8/18/2006 9:12 AM 32.12 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\WSCRIPT.EXE-0C5C5251.pf 8/16/2006 1:31 PM 23.61 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\WUPDMGR.EXE-08F70643.pf 8/14/2006 11:55 AM 19.93 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\YMSGR_TRAY.EXE-32093577.pf 8/15/2006 6:09 PM 21.11 KB Visible in Windows API, MFT, but not in directory index.
C:\WINDOWS\Prefetch\YUPDATER.EXE-1C2321B0.pf 8/19/2006 7:49 AM 25.06 KB Visible in Windows API, MFT, but not in directory index.

Susan528

Post #4August 22, 2006, 12:39 AM UTC

Hello Retire_Early,

You do not have any rootkits present which is good. Let's do the following scans.

STEP 1.
======
SpySweeper
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

If you are taken to the internet page, just close the page.

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

STEP 2.
======
The Ewido program’s detection rate is excellent. After the Trial has expired, the auto updates and real time protection stop but you can still update it manually and run scans anytime you want.

First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

Once you have downloaded ewido anti-spyware, locate the icon on the desktop
and double-click it to launch the set up program.
Once the setup is complete you will need run ewido and update the definition
files.
On the main screen select the icon "Update" then select the "
Update now" link.
- Next select the "Start Update" button, the update will start and a
  progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then
select "Quarantine".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

Reboot your computer into SafeMode. You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.

Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while ewido is scanning, it may interfere with the scanning proccess:
Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
ewido will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all
actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
Close ewido and reboot your system back into Normal Mode and post the
results of the ewido report scan.

Please post the results from SpySweeper, ewido and a new hijackthis log.

Deleted Member

Post #5August 22, 2006, 3:22 AM UTC

Results of Spy Sweeper, Ewido and HJT… Looks like Ewido found a few nasties… Thanks for your continued help! What's next?

8:49 PM: Removal process completed. Elapsed time 00:01:05
8:49 PM: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST24D.tmp". Reason: The system cannot find the file specified
8:49 PM: Warning: Failed to delete profile shadow file ".log". Reason: The system cannot find the file specified
8:49 PM: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST24D.tmp". Reason: The system cannot find the file specified
8:49 PM: Warning: Failed to delete profile shadow file ".log". Reason: The system cannot find the file specified
8:49 PM: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST24D.tmp". Reason: The system cannot find the file specified
8:49 PM: Warning: Failed to delete profile shadow file ".log". Reason: The system cannot find the file specified
8:49 PM: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST24E.tmp". Reason: The system cannot find the file specified
8:49 PM: Warning: Failed to delete profile shadow file ".log". Reason: The system cannot find the file specified
8:49 PM: Quarantining All Traces: server.iad.liveperson cookie
8:49 PM: Quarantining All Traces: overture cookie
8:49 PM: Quarantining All Traces: yieldmanager cookie
8:49 PM: Quarantining All Traces: 2o7.net cookie
8:49 PM: Quarantining All Traces: twain-tech
8:49 PM: Quarantining All Traces: webhancer
8:49 PM: Quarantining All Traces: dropspam toolbar
8:49 PM: Quarantining All Traces: cws_tiny0
8:49 PM: Quarantining All Traces: seekmo search assistant
8:49 PM: Quarantining All Traces: dropspam hijack
8:49 PM: Quarantining All Traces: directrevenue-abetterinternet
8:49 PM: Quarantining All Traces: spysheriff fakealert
8:49 PM: Quarantining All Traces: 180search assistant/zango
8:48 PM: Removal process initiated
8:47 PM: Traces Found: 68
8:47 PM: Full Sweep has completed. Elapsed time 00:32:59
8:47 PM: File Sweep Complete, Elapsed Time: 00:30:30
8:42 PM: c:\recycler\s-1-5-21-290517498-1469846268-3875676638-1006\dc1388\alchem.ini (ID = 83112)
8:42 PM: c:\recycler\s-1-5-21-290517498-1469846268-3875676638-1006\dc1388\alchem.inf (ID = 83109)
8:42 PM: Found Adware: directrevenue-abetterinternet
8:42 PM: C:\WINDOWS\INF\polmx.inf (ID = 81856)
8:42 PM: C:\Documents and Settings\Greg\Local Settings\Temp\polmx.inf (ID = 81856)
8:42 PM: C:\Documents and Settings\Donna\Local Settings\Temp\polmx.inf (ID = 81856)
8:42 PM: C:\Documents and Settings\Donna\Local Settings\Temp\twaintec.inf (ID = 81889)
8:42 PM: Found Adware: twain-tech
8:41 PM: C:\Program Files\secure32.html (ID = 184319)
8:41 PM: Found Adware: spysheriff fakealert
8:40 PM: Warning: Failed to open file "c:\documents and settings\donna\local settings\temporary internet files\content.ie5\e1kh4n67\search[1].". The operation completed successfully
8:32 PM: c:\recycler\s-1-5-21-290517498-1469846268-3875676638-1006\dc1388\icd1.tmp\saix.dll (ID = 324717)
8:29 PM: C:\WINDOWS\wh.exe (ID = 185167)
8:29 PM: Found Adware: webhancer
8:29 PM: C:\WINDOWS\dslife.exe (ID = 185113)
8:27 PM: C:\ntdetect.hta (ID = 57045)
8:27 PM: Found Adware: cws_tiny0
8:17 PM: C:\Program Files\dslifestyle (ID = 2147501137)
8:16 PM: Starting File Sweep
8:16 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
8:16 PM: c:\documents and settings\greg\cookies\[removed][1].txt (ID = 3341)
8:16 PM: Found Spy Cookie: server.iad.liveperson cookie
8:16 PM: c:\documents and settings\greg\cookies\[removed][1].txt (ID = 3106)
8:16 PM: c:\documents and settings\greg\cookies\greg@overture[2].txt (ID = 3105)
8:16 PM: c:\documents and settings\greg\cookies\[removed][1].txt (ID = 3106)
8:16 PM: Found Spy Cookie: overture cookie
8:16 PM: c:\documents and settings\greg\cookies\[removed][1].txt (ID = 3751)
8:16 PM: Found Spy Cookie: yieldmanager cookie
8:16 PM: c:\documents and settings\greg\cookies\greg@2o7[1].txt (ID = 1957)
8:16 PM: Found Spy Cookie: 2o7.net cookie
8:16 PM: Starting Cookie Sweep
8:16 PM: Registry Sweep Complete, Elapsed Time:00:00:35
8:16 PM: HKU\S-1-5-21-290517498-1469846268-3875676638-1006\software\dropspam\ (ID = 956996)
8:16 PM: HKU\WRSS_Profile_S-1-5-21-290517498-1469846268-3875676638-1008\software\seekmo\ (ID = 1042251)
8:16 PM: HKU\WRSS_Profile_S-1-5-21-290517498-1469846268-3875676638-1009\software\seekmo\ (ID = 1042251)
8:16 PM: Found Adware: seekmo search assistant
8:16 PM: HKU\WRSS_Profile_S-1-5-21-290517498-1469846268-3875676638-1009\software\dropspamtoolbar\ (ID = 956998)
8:16 PM: HKU\WRSS_Profile_S-1-5-21-290517498-1469846268-3875676638-1009\software\dropspam\ (ID = 956996)
8:16 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\saix.dll (ID = 1156675)
8:16 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/saix.dll\ (ID = 1156667)
8:16 PM: HKLM\software\classes\lmgr180.wmdrmax.1\ (ID = 1151753)
8:16 PM: HKCR\lmgr180.wmdrmax.1\ (ID = 1151708)
8:16 PM: Found Adware: 180search assistant/zango
8:16 PM: HKLM\software\microsoft\internet explorer\main\ || search page (ID = 957317)
8:16 PM: Found Adware: dropspam hijack
8:16 PM: HKLM\software\microsoft\internet explorer\extensions\{b6e649fa-5461-40d7-ab4d-54fc3c8db767}\ (ID = 957164)
8:16 PM: HKLM\software\classes\typelib\{f45e6252-3fb8-4876-b185-cdc91f42165d}\ (ID = 957154)
8:16 PM: HKLM\software\classes\typelib\{9ca78f1b-ee6b-4fd0-84e0-794d58a51496}\ (ID = 957131)
8:16 PM: HKLM\software\classes\typelib\{8220059c-d959-4f27-b559-179a8c5efdc1}\ (ID = 957121)
8:16 PM: HKLM\software\classes\clsid\{88b79166-13ab-4d04-aee8-7ab1cde75d7e}\ (ID = 957109)
8:16 PM: HKLM\software\classes\clsid\{5d50d513-e136-4f9f-b610-c7805e5f2491}\ (ID = 957096)
8:16 PM: HKLM\software\classes\clsid\{3058b2ea-a146-451a-916a-a5dcce7fa0b7}\ (ID = 957084)
8:16 PM: HKLM\software\classes\clsid\{2dea8791-c2b7-48e1-8992-8e8e6a6fe789}\ (ID = 957072)
8:16 PM: HKLM\software\classes\clsid\{1d95d4b4-f3de-4bde-af1d-219b23b58986}\ (ID = 957059)
8:16 PM: HKLM\software\classes\appid\{54ac0313-c709-4f55-a430-ec7e89f74665}\ (ID = 957057)
8:16 PM: HKLM\software\classes\appid\oesrv.exe\ (ID = 957055)
8:16 PM: HKLM\software\classes\oesrv.oeinterface.1\ (ID = 957051)
8:16 PM: HKLM\software\classes\oesrv.oeinterface\ (ID = 957045)
8:16 PM: HKLM\software\classes\oehk.oerebar.1\ (ID = 957041)
8:16 PM: HKLM\software\classes\oehk.oerebar\ (ID = 957035)
8:16 PM: HKLM\software\classes\ewwotb.addin.1\ (ID = 957031)
8:16 PM: HKLM\software\classes\ewwotb.addin\ (ID = 957025)
8:16 PM: HKLM\software\classes\ewwie.popcounter.1\ (ID = 957021)
8:16 PM: HKLM\software\classes\ewwie.popcounter\ (ID = 957015)
8:16 PM: HKLM\software\classes\ewwie.band.1\ (ID = 957011)
8:16 PM: HKLM\software\classes\ewwie.band\ (ID = 957005)
8:16 PM: HKCR\typelib\{f45e6252-3fb8-4876-b185-cdc91f42165d}\ (ID = 956986)
8:16 PM: HKCR\typelib\{9ca78f1b-ee6b-4fd0-84e0-794d58a51496}\ (ID = 956963)
8:16 PM: HKCR\typelib\{8220059c-d959-4f27-b559-179a8c5efdc1}\ (ID = 956953)
8:16 PM: HKCR\clsid\{88b79166-13ab-4d04-aee8-7ab1cde75d7e}\ (ID = 956941)
8:16 PM: HKCR\clsid\{5d50d513-e136-4f9f-b610-c7805e5f2491}\ (ID = 956928)
8:16 PM: HKCR\clsid\{3058b2ea-a146-451a-916a-a5dcce7fa0b7}\ (ID = 956916)
8:16 PM: HKCR\clsid\{2dea8791-c2b7-48e1-8992-8e8e6a6fe789}\ (ID = 956904)
8:16 PM: HKCR\clsid\{1d95d4b4-f3de-4bde-af1d-219b23b58986}\ (ID = 956891)
8:16 PM: HKCR\appid\{54ac0313-c709-4f55-a430-ec7e89f74665}\ (ID = 956889)
8:16 PM: HKCR\oesrv.oeinterface.1\ (ID = 956883)
8:16 PM: HKCR\oesrv.oeinterface\ (ID = 956877)
8:16 PM: HKCR\oehk.oerebar.1\ (ID = 956873)
8:16 PM: HKCR\oehk.oerebar\ (ID = 956867)
8:16 PM: HKCR\ewwotb.addin.1\ (ID = 956863)
8:16 PM: HKCR\ewwotb.addin\ (ID = 956857)
8:16 PM: HKCR\ewwie.popcounter.1\ (ID = 956853)
8:16 PM: HKCR\ewwie.popcounter\ (ID = 956847)
8:16 PM: HKCR\ewwie.band.1\ (ID = 956843)
8:16 PM: HKCR\ewwie.band\ (ID = 956837)
8:16 PM: Found Adware: dropspam toolbar
8:16 PM: Starting Registry Sweep
8:16 PM: Memory Sweep Complete, Elapsed Time: 00:01:37
8:14 PM: Starting Memory Sweep
8:14 PM: Sweep initiated using definitions version 745
8:14 PM: Spy Sweeper 5.0.5.1286 started
8:14 PM: | Start of Session, Monday, August 21, 2006 |
********
8:14 PM: | End of Session, Monday, August 21, 2006 |
8:14 PM: Your spyware definitions have been updated.
Keylogger Shield: On
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
8:10 PM: Messenger service has been disabled.
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
8:10 PM: Shield States
8:10 PM: Spyware Definitions: 691
8:09 PM: Spy Sweeper 5.0.5.1286 started
8:09 PM: Spy Sweeper 5.0.5.1286 started
8:09 PM: | Start of Session, Monday, August 21, 2006 |
********

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 9:56:36 PM 8/21/2006

+ Scan result:

C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1388\msin_installer1\invexactdy8.exe -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\Documents and Settings\Greg\Local Settings\Temp\jbridgep.sys -> Backdoor.Genlot.DX : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1388\jbridgep.sys -> Backdoor.Genlot.DX : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wmdconf32.dll -> Logger.Goldun.cr : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1359.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc103.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1036.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1126.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1358.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc171.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc2.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc313.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc377.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc386.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc66.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc7.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc71.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc954.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1102.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc921.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc42.txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc850.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1365.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1368.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1253.txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1355.txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc628.txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc104.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1254.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1356.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1369.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc629.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc976.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc117.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1370.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc138.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1325.txt -> TrackingCookie.Dbbsrv : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1333.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc107.txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1027.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1028.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1029.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1030.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1031.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1032.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc188.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc189.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc190.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc191.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc192.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc193.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc194.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc195.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc196.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc197.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc198.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc199.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc200.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc201.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc202.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc203.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc204.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc205.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc206.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc207.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc208.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc209.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc210.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc211.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc212.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc213.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc214.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc215.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc216.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc22.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc842.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc843.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc844.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc845.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc846.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc847.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1362.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc37.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc932.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc885.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1337.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc108.txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1334.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1339.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1074.txt -> TrackingCookie.Itrack : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc465.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc487.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1075.txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc295.txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1342.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc737.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1002.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc155.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc156.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc402.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc416.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1363.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc50.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1345.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc443.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc450.txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc225.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc38.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc883.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc933.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1056.txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1224.txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc516.txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1211.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc534.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc69.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc953.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1100.txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc345.txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1352.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1353.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc557.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc874.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1237.txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc579.txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc829.txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc432.txt -> TrackingCookie.Wegcash : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc1360.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc32.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc5596.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc901.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc926.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc106.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-290517498-1469846268-3875676638-1006\Dc852.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
C:\WINDOWS\aac.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined).
C:\WINDOWS\exactofferd8.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined).

::Report end

Logfile of HijackThis v1.99.1
Scan saved at 10:08:29 PM, on 8/21/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\Norton\Navnt\navapsvc.exe
C:\PROGRA~1\Norton\Navnt\npssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Norton\Navnt\navapw32.exe
C:\PROGRA~1\Norton\Navnt\alertsvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cyclonecorvette.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [SmcService] "C:\PROGRA~1\Sygate\SPF\smc.exe" -startgui
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Norton\Navnt\npscheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Norton\Navnt\navapw32.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…arch.jhtml?p=ZN
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.principal.com/ica32t.exe
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsr.cab
O16 - DPF: {5EB6A98B-F75B-4AC7-821D-BAD2C29D18C2} (CVALAXObj Class) - https://autoins1.progressivedirect.com/ptt/cv/CVALAX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106978890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106962937
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neutral/co….cab?10,0,910,0
O20 - AppInit_DLLs: C:\WINDOWS\System32\win_i2.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NAV Alert - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\navapsvc.exe
O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\npssvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Susan528

Post #6August 22, 2006, 1:13 PM UTC

Disable SpySweeper:
You have SpySweeper installed. While this is a great program, we need to temporarily disable (not uninstall) the program because it might stop our fix.
Right click on the SpySweeper icon in your System Tray (near the clock).
From the pop up menu, left click on Shields, this will open the program at the same time.
Click the "Internet Explorer" tab and uncheck the following:

IE Favorites Shield
IE Security Shield
Broswer Helper Object (BHO) Shield
IE Hijack Shield

Click the "Windows System Shields" and uncheck the following:

Memory Shield
Spy Installation Shield

Click the "Startup Programs" tab and uncheck the Startup Items Shield

Scan with HijackThis. Place a check against each of the following:
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…arch.jhtml?p=ZN
O20 - AppInit_DLLs: C:\WINDOWS\System32\win_i2.dll
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Please enable SpySweeper again.

Post (reply) with a fresh HijackThis log and we will take another look. Please tell me how you computer seems to be running now.

Deleted Member

Post #7August 22, 2006, 10:18 PM UTC

Susan,
Looking good. As for computer performance, it's running a bit slow, but I think that's a combination of SpySweeper, Ewido and NAV all running in the background and a computer that's a few years old/underpowered. How's this look? As always, thanks much!

Logfile of HijackThis v1.99.1
Scan saved at 5:03:48 PM, on 8/22/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\Norton\Navnt\navapsvc.exe
C:\PROGRA~1\Norton\Navnt\npssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Norton\Navnt\navapw32.exe
C:\PROGRA~1\Norton\Navnt\alertsvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cyclonecorvette.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [SmcService] "C:\PROGRA~1\Sygate\SPF\smc.exe" -startgui
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Norton\Navnt\npscheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Norton\Navnt\navapw32.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.principal.com/ica32t.exe
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsr.cab
O16 - DPF: {5EB6A98B-F75B-4AC7-821D-BAD2C29D18C2} (CVALAXObj Class) - https://autoins1.progressivedirect.com/ptt/cv/CVALAX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106978890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106962937
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neutral/co….cab?10,0,910,0
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NAV Alert - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\navapsvc.exe
O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\npssvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Deleted Member

Post #8August 22, 2006, 10:22 PM UTC

Just realized I hadn't re-enabled SpySweeper before running HJT in my last post. Here's the latest HJT with SpySweeper enabled.

Logfile of HijackThis v1.99.1
Scan saved at 5:12:23 PM, on 8/22/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\Norton\Navnt\navapsvc.exe
C:\PROGRA~1\Norton\Navnt\npssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Norton\Navnt\navapw32.exe
C:\PROGRA~1\Norton\Navnt\alertsvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cyclonecorvette.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [SmcService] "C:\PROGRA~1\Sygate\SPF\smc.exe" -startgui
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Norton\Navnt\npscheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Norton\Navnt\navapw32.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.principal.com/ica32t.exe
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…trl/tgctlsr.cab
O16 - DPF: {5EB6A98B-F75B-4AC7-821D-BAD2C29D18C2} (CVALAXObj Class) - https://autoins1.progressivedirect.com/ptt/cv/CVALAX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106978890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125106962937
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neutral/co….cab?10,0,910,0
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NAV Alert - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\navapsvc.exe
O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Norton\Navnt\npssvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Susan528

Post #9August 22, 2006, 11:52 PM UTC

Hi Retire Early,

Your logs appear to be clean. Norton can slow down a system some. Here are some final recommendations. You need to go to the Microsoft site and update your Windows. You only have SP1 installed.

STEP 1.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Test your Firewall - Please test your firewall and make sure it is working properly.
Test Firewall
Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
A tutorial on installing & using this product can be found here:
Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
More info on how to prevent malware you can also find here (By Tony Klein)

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan

Deleted Member

Post #10August 24, 2006, 12:57 AM UTC

[*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

OK. Changed settings to auto update.

[*]Test your Firewall - Please test your firewall and make sure it is working properly.

Test Firewall

Good. All Ports and Access points invisible.

[*]Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Got a bit hung up on this one. 53 security updates (over 200mb). Downloaded but locked up on installation. Was able to split these out and now have all updates installed. Also changed settings to auto update in future.

[*]Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

A tutorial on installing & using this product can be found here:
Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

Already have/use Ad-Aware and Spybot. Just need to be diligent in frequent updates.

[*]Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Done.

[*]Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Also wanted to mention that I uninstalled Ewigo and SpySweeper trial versions and system performance improved dramatically. Thought this might be helpful for others to know if they had similar super slow response time after this thorough cleaning.

Follow this list and your potential for being infected again will reduce dramatically.

Thanks much. I really appreciate your help! Time to donate!

Susan528

Post #11August 24, 2006, 1:17 AM UTC

Glad we could help! Enjoy retirement! Thank you for any donation.

Deleted Member

Post #12August 24, 2006, 1:19 AM UTC

Susan - not able to use PM on the board but would like to ask a question offline. Is this possible?

Susan528

Post #13August 25, 2006, 10:20 AM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Downloader/Infostealer Help please

✨ Ask AI

Ask AI