Black 2/3 of Desktop; Blinking Cursor; Slow Computer: SQLEXPRESS insta

Sir,

Thanks a million times; one is down now…the Desktop is restored. But I failed to install Spy Sweeper AS 'something continually eats it". A few minutes after installation it reports back that it has been damaged ,,,,please re-install it. And, Ewido reports that "Something bad happened to the ewido programs saved in ….."

Otherwise, the three logs appear hereunder. I guess it will work this time….I mean the speed and all the INFECTIONS coming in will be stopped..



Logfile of HijackThis v1.99.1
Scan saved at 21:56:40, on 21/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
C:\WINDOWS\system32\dslagent.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\AOL\1133037534\ee\AOLHostManager.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
C:\PROGRA~1\McAfee\MSC\McLogCln.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Common Files\AOL\1133037534\ee\AOLServiceHost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterConfig.exe
C:\Program Files\Motorola\Motorola Desktop Suite\DesktopSuite.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\AOL\1133037534\ee\AOLServiceHost.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\symbian\shared\SYMBIA~1\SYMBIA~1.EXE
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\symbian\shared\SYMBIA~1\SCBal.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\vssvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\PROGRA~1\MOZILL~1\firefox.exe
C:\Documents and Settings\FERRARI\Desktop\hijackthis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~1.EXE

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Messenger\ycomp.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptsn.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Messenger\ycomp.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1133037534\ee\AOLHostManager.exe"
O4 - HKLM\..\Run: [DSLAGENTEXE] "dslagent.exe" USB
O4 - HKLM\..\Run: [ViewMgr] "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" -onlytray
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SpywareBot] "C:\PROGRA~1\SPYWAR~1\SpywareBot.exe" -boot
O4 - HKLM\..\Run: [McLogLch_exe] "C:\Program Files\McAfee\MSC\McLogLch.exe"
O4 - HKLM\..\Run: [MskAgentexe] "C:\Program Files\McAfee\MSK\MskAgent.exe"
O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKCU\..\Run: [STManager] "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b
O4 - HKCU\..\Run: [PcSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog
O4 - HKCU\..\Run: [ATI Remote Control] "C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Motorola Desktop Suite mRouter Config.lnk = C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterConfig.exe
O4 - Global Startup: Motorola Desktop Suite.lnk = C:\Program Files\Motorola\Motorola Desktop Suite\DesktopSuite.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod2\v4\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod2\v4\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8…pdatePortal.cab
O16 - DPF: {61A7208D-F61E-4A04-BB36-E10EFF6DDD76} (SndRec Control) - http://www.thedatehub.com/member/webmaster/websndrec.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120304017203
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126835439734
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,23/mcgdmgr.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.cab
O16 - DPF: {DEDA29CA-3653-456E-B4C9-63A5D85D35D6} (AXVidCap Control) - http://www.thedatehub.com/member/webmaster/AXVidCap.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/35/install/gtdownde.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…645/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{13966355-6C91-42D8-B3CE-3B07BD3EF227}: NameServer = 83.146.21.6 212.158.248.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{13966355-6C91-42D8-B3CE-3B07BD3EF227}: NameServer = 83.146.21.6 212.158.248.5
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: MBackMonitor - - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


HERE ARE THE OTHER LOGS SIR

ewido anti-spyware - Scan Report
———————————————————

+ Created at: 21:13:35 21/08/2006

+ Scan result:



C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP409\A0043012.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP436\A0047080.exe -> Downloader.Small : Cleaned with backup (quarantined).
:mozilla.118:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.120:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.136:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\FERRARI\Cookies\ferrari@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.45:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.46:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.47:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.48:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.41:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.137:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
:mozilla.49:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
:mozilla.63:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.64:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.65:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.66:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.67:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.160:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).
:mozilla.103:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.105:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.106:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.21:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.22:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.42:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
:mozilla.43:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
:mozilla.115:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.116:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.68:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.69:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.73:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.83:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.84:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.98:C:\Documents and Settings\FERRARI\Application Data\Mozilla\Firefox\Profiles\fwqrp1cy.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).


::Report end

**********************

SmitFraudFix v2.81

Scan done at 19:18:18.01, 21/08/2006
Run from C:\Documents and Settings\FERRARI\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\FERRARI\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\FERRARI\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

*****************************************


13:20: Removal process completed. Elapsed time 00:00:56
13:20: Quarantining All Traces: 2o7.net cookie
13:20: Quarantining All Traces: webtrendslive cookie
13:20: Quarantining All Traces: nextag cookie
13:20: Quarantining All Traces: webtrends cookie
13:20: Quarantining All Traces: excite cookie
13:20: Quarantining All Traces: atlas dmt cookie
13:20: Quarantining All Traces: tacoda cookie
13:20: Quarantining All Traces: advertising cookie
13:20: Quarantining All Traces: xpehbam dialer
13:20: Quarantining All Traces: secure.html
13:20: Quarantining All Traces: trojan-backdoor-securemulti
13:19: Removal process initiated
13:18: Traces Found: 13
13:18: Full Sweep has completed. Elapsed time 00:26:08
13:18: File Sweep Complete, Elapsed Time: 00:18:54
13:18: Warning: Failed to access drive E:
13:17: C:\WINDOWS\seksdialer.exe (ID = 90847)
13:17: Found Adware: xpehbam dialer
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_kfau6p40fw30roz". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_r8sdtq1c4p9cgfi". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_chajkec9iq2ja8z". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_afn9rimhb7wiwg4". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_o0mwm8rmxifrqbl". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_gy7g5i5pleu9roe". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_b4dwabn6ythab50". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_aflzqj2sing9vwt". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_931aydtonxmelht". The operation completed successfully
13:16: Warning: Failed to open file "c:\windows\temp\sqlite_gkviexeq6jn1jjf". The operation completed successfully
13:16: Warning: Failed to open file "c:\documents and settings\localservice\cookies\system@mcafee[1].txt". The operation completed successfully
12:59: Starting File Sweep
12:59: Warning: Failed to access drive A:
12:59: Cookie Sweep Complete, Elapsed Time: 00:00:01
12:59: c:\documents and settings\localservice\cookies\ferrari@excite[2].txt (ID = 2631)
12:59: c:\documents and settings\ferrari\cookies\ferrari@tacoda[1].txt (ID = 6444)
12:59: c:\documents and settings\ferrari\cookies\ferrari@sento.122.2o7[1].txt (ID = 1958)
12:59: Found Spy Cookie: 2o7.net cookie
12:59: c:\documents and settings\ferrari\cookies\ferrari@S005-01-9-28-233860-106434[2].txt (ID = 3679)
12:59: Found Spy Cookie: webtrendslive cookie
12:59: c:\documents and settings\ferrari\cookies\ferrari@nextag[2].txt (ID = 5014)
12:59: Found Spy Cookie: nextag cookie
12:59: c:\documents and settings\ferrari\cookies\[removed][1].txt (ID = 3669)
12:59: Found Spy Cookie: webtrends cookie
12:59: c:\documents and settings\ferrari\cookies\ferrari@excite[1].txt (ID = 2631)
12:59: Found Spy Cookie: excite cookie
12:59: c:\documents and settings\ferrari\cookies\ferrari@atdmt[2].txt (ID = 2253)
12:59: Found Spy Cookie: atlas dmt cookie
12:59: c:\documents and settings\ferrari\cookies\[removed][1].txt (ID = 6445)
12:59: Found Spy Cookie: tacoda cookie
12:59: c:\documents and settings\ferrari\cookies\ferrari@advertising[1].txt (ID = 2175)
12:59: Found Spy Cookie: advertising cookie
12:59: Starting Cookie Sweep
12:59: Registry Sweep Complete, Elapsed Time:00:01:34
12:58: HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload\ || system (ID = 766569)
12:58: Found Trojan Horse: trojan-backdoor-securemulti
12:58: HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload\ || system (ID = 141364)
12:58: Found Adware: secure.html
12:57: Starting Registry Sweep
12:57: Memory Sweep Complete, Elapsed Time: 00:05:27
12:52: Starting Memory Sweep
12:52: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
12:52: Sweep initiated using definitions version 744
12:52: Spy Sweeper 5.0.5.1286 started
12:52: | Start of Session, 21 August 2006 |
********
12:52: | End of Session, 21 August 2006 |
12:50: Your definitions are up to date.
12:49: Your spyware definitions have been updated.
Operation: File Access
Target:
Source: C:\PROGRA~1\MCAFEE\VIRUSS~1\MCSHIELD.EXE
12:49: Tamper Detection
Keylogger Shield: On
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
12:48: Shield States
12:47: Spyware Definitions: 691
12:43: Spy Sweeper 5.0.5.1286 started
12:43: Spy Sweeper 5.0.5.1286 started
12:43: | Start of Session, 21 August 2006 |
********



Thank you again for writing , I hope to hear from you soon as usual.

Yours faithfully
Mutoro

PS

Sorry, maybe they are mixed up…but I hope the times may help. Sorry about that again, I dont remember the order I got them.