What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

getting stuff like twain tech detected and others at times

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 6:24:45 AM, on 9/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\YAHOO!\browser\ybrwicon.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\YAHOO!\YOP\yop.exe
C:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXE
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
C:\Program Files\Common Files\Verizon Online\ConnMgr\cmisrv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Common Files\Verizon Online\AppMgr\vzOpenUIServer.exe
E:\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…://www.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…&ar=msnhome
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9022
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\2.bin\ND2FNBAR.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: RX Toolbar - {25D8BACF-3DE2-4B48-AE22-D659B8D835B0} - C:\Program Files\RXToolBar\RXToolBar.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\YAHOO!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\YAHOO!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [A Verizon App] C:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?86c250c554b0439fafbdc0ee2a72e83d
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?86c250c554b0439fafbdc0ee2a72e83d
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Verizon Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/downl…wlscbase969.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1135112496857
O16 - DPF: {88B507F9-C6B2-45CC-AAB6-720A652DE11C} (TenOfTen Class) - https://download.verizon.net/sfp/Cabs/hst/w…tWebInstall.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta…es/vzWebIns.CAB
O16 - DPF: {DB0474CC-8EF6-47FC-905B-23FC58A70817} (RegPropsCtrl Class) - https://download.verizon.net/sfp/Cabs/hst/w…tWebInstall.cab
O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 5:43:19 AM 9/2/2006

+ Scan result:



C:\Documents and Settings\Jason\Local Settings\Temp\ADMCache\admC8.tmp/asm.exe -> Adware.Altnet : No action taken.
C:\Documents and Settings\Jason\Local Settings\Temp\ADMCache\admC8.tmp/asmps.dll -> Adware.Altnet : No action taken.
C:\Program Files\Altnet -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\DBBackup -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\DBBackup\Sigfiles.db -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\adm25.dll -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\adm4.dll -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\adm4005.exe -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\admdata.dll -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\admdloader.dll -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\admfdi.dll -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\admprog.dll -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\altnetuninstall.exe -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\asm.exe -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\asmend.exe -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\dminfo3.cab -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\dminstall7.cab -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\dmsetup.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\dmsetupbig.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\jsinstall.cab -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\jslegals.txt -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\selectdir.txt -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Download Manager\selectdir1st.txt -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\My Altnet Shares -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\altnet.css -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\gradient.gif -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\local_firstuse.html -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\local_points.html -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\local_redeem.html -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\local_start.html -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\local_wallet.html -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\notconnected.gif -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\offline.gif -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\LocalPages\pixel.gif -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Points Manager.exe.Manifest -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\Help.xml -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\Sav3BD.tmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\Skin.xml -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\back-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\back.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\bottom.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\bottomleft.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\bottomright.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\close-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\close.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\forward-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\forward.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\help-bottom.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\help-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\help-sel.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\help-top.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\help-topleft.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\help-topright.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\help.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\left.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\maximise-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\maximise.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\mb_bottom.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\mb_bottomleft.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\mb_bottomright.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\mb_left.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\mb_right.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\mb_top.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\mb_topleft.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\mb_topright.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\message.xml -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\minimise-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\minimise.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\points-disabled.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\points-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\points-sel.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\points.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\redeem-disabled.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\redeem-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\redeem-sel.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\redeem.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\refresh-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\refresh.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\right.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\settings-disabled.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\settings-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\settings-sel.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\settings.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\start-disabled.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\start-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\start-sel.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\start.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\top.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\topleft-pro.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\topleft-reg.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\topleft.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\topright.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\wallet-disabled.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\wallet-over.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\wallet-sel.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Skin\wallet.bmp -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\Temp Internet Shares -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\settings.cab -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\setup.cab -> Adware.Altnet : No action taken.
C:\Program Files\Altnet\Points Manager\sysdetect.dll -> Adware.Altnet : No action taken.
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP29\A0000773.exe -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\Atl.dll -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\DMinfo3.cab -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\Setup.cab -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\Setup.exe -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\adm.exe -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\adm25.dll -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\adm4.dll -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\admdata.dll -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\admdloader.dll -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\admfdi.dll -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\admprog.dll -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\dmfiles.cab -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\dminstall7.cab -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\msvcirt.dll -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\mysearch.cab -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\pmexe.cab -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\pmfiles.cab -> Adware.Altnet : No action taken.
C:\WINDOWS\Temp\Altnet\pminstall.cab -> Adware.Altnet : No action taken.
E:\Program Files\Altnet\Download Manager\asm.exe -> Adware.Altnet : No action taken.
E:\Program Files\Altnet\Download Manager\asmps.dll -> Adware.Altnet : No action taken.
E:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP29\A0000772.exe -> Adware.Altnet : No action taken.
E:\kazaa_setup.exe -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\ADM -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\ADM\ADMCache -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\Dashboard -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\Dashboard\Settings -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\Dashboard\Setup -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\Dashboard\Temp Internet Shares -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\DownloadManager -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\LocalFiles -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Altnet\TopSearch -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM.ADM -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM.ADM.1 -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM.ADM\CLSID -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM.ADM\CurVer -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM25.ADM25 -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM25.ADM25.1 -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM25.ADM25\CurVer -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM4.ADM4 -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM4.ADM4.1 -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\ADM4.ADM4\CurVer -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\SigningModule.SigningModule -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\SigningModule.SigningModule.1 -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\SigningModule.SigningModule\CLSID -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\SigningModule.SigningModule\CurVer -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\TopSearch.TSLink -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\TopSearch.TSLink.1 -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\TopSearch.TSLink\CLSID -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Classes\TopSearch.TSLink\CurVer -> Adware.Altnet : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AltnetDM -> Adware.Altnet : No action taken.
C:\WINDOWS\system32\AdCache -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_0_0_106800.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_0_0_107400.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_1_0_449200.gif -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_1_0_449600.gif -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_1_0_454300.gif -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_2_0_105300.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_2_0_106800.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_2_0_107400.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_3_0_106800.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_3_0_107400.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_4_0_111600.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_4_0_152400.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_4_0_155300.htm -> Adware.Cydoor : No action taken.
C:\WINDOWS\system32\AdCache\B_329_4_0_164100.htm -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_0 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_0\Level_0 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_0\Level_0\Seqn_1068 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_0\Level_0\Seqn_1074 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_1 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_1\Level_0 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_1\Level_0\Seqn_4492 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_1\Level_0\Seqn_4496 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_1\Level_0\Seqn_4543 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_2 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_2\Level_0 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_2\Level_0\Seqn_1053 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_2\Level_0\Seqn_1068 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_2\Level_0\Seqn_1074 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_3 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_3\Level_0 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_3\Level_0\Seqn_1068 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_3\Level_0\Seqn_1074 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_4 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_4\Level_0 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_4\Level_0\Seqn_1116 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_4\Level_0\Seqn_1524 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_4\Level_0\Seqn_1553 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_4\Level_0\Seqn_1641 -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Services -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Services\Queue -> Adware.Cydoor : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Kazaa\Promotions\Cydoor\Adwr_329\Services\Status -> Adware.Cydoor : No action taken.
C:\WINDOWS\Downloaded Program Files\WebP2PInstaller.dll -> Adware.PeerNet : No action taken.
C:\Program Files\RXToolBar -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Cache -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\CacheCatalog.rx -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Cache\RXUpdate -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\HTML -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\HTML\content.htm -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\HTML\main.htm -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\CustomerSecret.Key -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\CustomerSecret.sig -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\bKPack01.01.dat -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\bKPack01.01.sig -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\bKPack01.dat -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\bKPack01.sig -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\bLabels01.dat -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\bLabels01.sig -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\nLabels01.dat -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\Semantic Insight\nLabels01.sig -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics\additional.gif -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics\additional_active.gif -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics\background.jpg -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics\blue_hr_horz.GIF -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics\gray_hr_horz.GIF -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics\thumbtack.gif -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics\thumbtack_active.gif -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\graphics\thumbtack_click.gif -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\rx.xml -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\rxtoolbar.cfg -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\rxwebsearches.xsl -> Adware.RXToolbar : No action taken.
C:\Program Files\RXToolBar\sfcont.bin -> Adware.RXToolbar : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{59879FA4-4790-461c-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : No action taken.
HKLM\SOFTWARE\Classes\RXToolBar.TBInfo -> Adware.RXToolbar : No action taken.
HKLM\SOFTWARE\Classes\RXToolBar.TBInfo.1 -> Adware.RXToolbar : No action taken.
HKLM\SOFTWARE\Classes\RXToolBar.TBInfo\CLSID -> Adware.RXToolbar : No action taken.
HKLM\SOFTWARE\Classes\RXToolBar.TBInfo\CurVer -> Adware.RXToolbar : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59879FA4-4790-461c-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{59879FA4-4790-461C-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : No action taken.
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\RX ToolBar -> Adware.RXToolbar : No action taken.


::Report end
Post #3 last edited
Hi,

It looks like you have a version of Kazaa installed which was bundled with spyware/malware. If you want to clean your system, then you will have to uninstall it along with the bundled applications. So, please do the following in the order given. You will need to copy or print these instructions because you will be working in Safe Mode without an Internet connection.

• Uninstall the following programs. Uninstall them in the order provided. Not all of them may be present.
- Go to Start -> Control Panel -> Add/Remove Programs
- Select RX Bar or RXToolbar and click Change/Remove
- Select InstaFinderK and click Change/Remove
- Select Need2Find Bar and click Change/Remove
- Select Peer Points Manager and click Change/Remove
- Select P2P Networking and click Change/Remove
- Select Kazaa and click Change/Remove
- Exit.

• Reboot your computer! (Important)

• We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make. After all of the fixes are complete it is very important that you enable Real-time Protection again.
* Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
* Click on Tools, General Settings
* Under Real-time protection options, unselect the Turn on real-time protection check box
* Click Save

• Reboot into SAFE MODE.
To get into the Windows XP Safe Mode, restart your computer and, just before Windows starts to load, tap the F8 key a few times. Choose Safe Mode from the menu that will appear and press Enter.

• Make sure that Windows Defender's Real-Time component is disabled. Sometimes, it will re-enable after a reboot.

• Start HijackThis, click System Scan Only and place a checkmark next to the following items:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9022
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll
O3 - Toolbar: RX Toolbar - {25D8BACF-3DE2-4B48-AE22-D659B8D835B0} - C:\Program Files\RXToolBar\RXToolBar.dll
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF}

Close ALL browsers and open windows/programs and click 'Fix Checked'.

• Navigate to and delete the following folders if present:
C:\Program Files\ALTNET
C:\Program Files\INSTALFNK
C:\Program Files\KAZAA
C:\Program Files\NEED2FIND
C:\Program Files\RXTOOLBAR

• Open Ewido Perform a Full/Complete System scan and save the report/log.
IMPORTANT! Do not save the report before you have clicked the Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button?

• Reboot back into Normal Mode.

• Post back with the log from the Ewido scan and a new HijackThis log.
Post #4
———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 8:31:13 PM 9/2/2006

+ Scan result:



C:\Documents and Settings\Jason\Local Settings\Temp\__unin__.exe -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000827.exe -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000851.exe -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000855.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000857.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000859.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000860.exe -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000861.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000862.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000864.exe -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000865.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP33\A0000883.exe -> Adware.Altnet : Cleaned with backup (quarantined).
E:\Recycled\De2\Download Manager\asm.exe -> Adware.Altnet : Cleaned with backup (quarantined).
E:\Recycled\De2\Download Manager\asmps.dll -> Adware.Altnet : Cleaned with backup (quarantined).
E:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP33\A0000885.exe -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM25.ADM25 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM25.ADM25.1 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM25.ADM25\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM4.ADM4 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM4.ADM4.1 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM4.ADM4\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\TopSearch.TSLink -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\TopSearch.TSLink.1 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\TopSearch.TSLink\CLSID -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\TopSearch.TSLink\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000832.dll -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000829.exe -> Adware.RXBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000868.dll -> Adware.RXBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{9381872B-99BE-40C4-B6D6-004EA9E11715}\RP32\A0000869.dll -> Adware.RXToolbar : Cleaned with backup (quarantined).
HKU\S-1-5-21-1659004503-764733703-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{59879FA4-4790-461C-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : Cleaned with backup (quarantined).


::Report end

Logfile of HijackThis v1.99.1
Scan saved at 7:56:14 PM, on 9/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\YAHOO!\browser\ybrwicon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\YAHOO!\YOP\yop.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Verizon Online\ConnMgr\cmisrv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Verizon Online\AppMgr\vzOpenUIServer.exe
E:\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…://www.live.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…&ar=msnhome
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\YAHOO!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\YAHOO!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [A Verizon App] C:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?86c250c554b0439fafbdc0ee2a72e83d
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?86c250c554b0439fafbdc0ee2a72e83d
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Verizon Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/downl…wlscbase969.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1135112496857
O16 - DPF: {88B507F9-C6B2-45CC-AAB6-720A652DE11C} (TenOfTen Class) - https://download.verizon.net/sfp/Cabs/hst/w…tWebInstall.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta…es/vzWebIns.CAB
O16 - DPF: {DB0474CC-8EF6-47FC-905B-23FC58A70817} (RegPropsCtrl Class) - https://download.verizon.net/sfp/Cabs/hst/w…tWebInstall.cab
O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Post #5
Your log looks clean now.

• You have an outdated version of Java which, because of security reasons, needs to be updated. To update Java:
- Go to Start -> Control Panel -> Add/Remove programs
- Search in the list for all previous installed versions of Java. (J2SE Runtime Environment…)
- Select the version(s) and click Remove
- Then download and install the newest version from here:
http://www.java.com/en/download/manual.jsp
- Reboot after installation.

• If you have not done so, please empty your Recycle Bin.

• Create a new Restore Point:
- Go to Start -> All Programs -> Accessories -> System Tools -> System Restore.
- When the utility opens, select "Create a new restore point" and click Next
- Name the restore point - something like "After infection cleaned" or "After cleaning"
- Click Create.

• Delete the old Restore Points:
- Go to Start -> All Programs -> Accessories -> System Tools -> Disk Cleanup. Click Ok.
- Click the "More Options" tab.
- Where it states "System Restore" - click Clean up.
- All of the old Restore Points will be deleted EXCEPT for the one you just created.

Reboot your computer!

• To keep this clean in the future, I would suggest the following things:

• Install Spywareblaster. SpywareBlaster doesn't scan and clean for so-called spyware but prevents it from being installed in the first place. It blocks the popular spyware ActiveX controls and also prevents the installation of any of them via a webpage. Update it periodically.

• Download ATF Cleaner by Atribune and save to your desktop.
This program is for XP and Windows 2000 only
This is a good program for periodically cleaning your system. Instructions are here

* Avoid illegal sites because that's where most malware is present.
* Don't click on links inside pop-ups. If you should get them, use ALT + F4 to close them.
* Don't click on links in spam messages claiming to offer anti-spyware software because most of these so-called removers ARE spyware.
* Download free software only from sites you know and trust because a lot of free software can bundle other software, including spyware.

• Let your anti-spyware scanner(s) scan frequently and don't forget to update before scanning.

• I suggest you perform an online virus-scan once in a while (Housecall and/or Bitdefender) because what one virus-scanner can't find, another one maybe can.
Also, make sure that your virus-scanner, the one that is already installed on your system, is always up to date!

• Make sure your Windows has the latest updates by going here.

• More information on how to prevent malware can be found at So how did I get infected in the first place? by Tony Klein.

Happy surfing again! :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI