Spyware / Malware / Virus Removal

mmm... Link Opzimizer or...?

6 min read

Looking for the outcome? Ask AI

Petauro Topic Starter

Post #1September 5, 2006, 6:06 PM UTC

hi, i think i've been attached by the virus "LINK OPTIMIZER". I Find 33 Virus With Kaspersky, making the Scan and deleting them, but the problem…is still here, every day, when i turn on my pc..and it goes out of control

Logfile of HijackThis v1.99.1
Scan saved at 19.38.45, on 05/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Java\jre1.5.0_01\bin\jusched.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Sebastiano\Impostazioni locali\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/Default.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\svchost.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {A60E1174-F5C6-2FC0-1BB2-328964BA8F56} - C:\WINDOWS\khcwg1.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [kpnx2.exe] C:\WINDOWS\Temp\kpnx2.exe
O4 - HKLM\..\Run: [kpnx1.exe] C:\WINDOWS\Temp\kpnx1.exe
O4 - HKLM\..\Run: [kav] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O12 - Plugin for .mov: C:\Programmi\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: www.1987324.com
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://yvy91yvonne.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: \\?\C:\WINDOWS\System32\con.fcc
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

therock247uk

Post #2September 5, 2006, 9:07 PM UTC last edited September 5, 2006, 9:37 PM UTC

Please download the Grozmon Removal Tool by Prevx.
Launch the program and click scan, when it locates the infection,it will tell you its going to reboot the machine and remove the infection.
Let the machine restart and wait for the tool to finish.
Locate the report the tool generates–> C:\armada_log.txt

Open Hijackthis and click scan. Then check mark the following entries

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\svchost.exe
O2 - BHO: Class - {A60E1174-F5C6-2FC0-1BB2-328964BA8F56} - C:\WINDOWS\khcwg1.dll (file missing)
O4 - HKLM\..\Run: [kpnx2.exe] C:\WINDOWS\Temp\kpnx2.exe
O4 - HKLM\..\Run: [kpnx1.exe] C:\WINDOWS\Temp\kpnx1.exe

Now close all open windows except Hijackthis and click fix checked

Restart the machine once more and scan fresh with HijackThis.

Post the results from HijackThis and armada_log.txt

Petauro

Post #3September 6, 2006, 6:21 PM UTC last edited September 6, 2006, 6:22 PM UTC

… i did the scan with Gromozon but i did't find the report C:\armada_log.txt, i find C:\gromozon_removal, so i retry but it give me again this file txt…
now this report tells:
Removal tool loaded into memory
Gromozon rootkit component not detected - searching for other components
Scanning: C:\WINDOWS
Scanning: C:\Programmi\File comuni

Trojan.Gromozon does not exist - your system is clean.
but the first report told me that all the file of Gromozon was removed… and there were a lot of file removed in C:\programmi\file comuni!

Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 19.47.41, on 06/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Java\jre1.5.0_01\bin\jusched.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Sebastiano\Impostazioni locali\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/Default.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [kav] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O12 - Plugin for .mov: C:\Programmi\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: www.1987324.com
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://yvy91yvonne.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: \\?\C:\WINDOWS\System32\con.fcc
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

therock247uk

Post #4September 6, 2006, 8:47 PM UTC

Open Hijackthis and click scan. Then check mark the following entries

O20 - AppInit_DLLs: \\?\C:\WINDOWS\System32\con.fcc

Now close all open windows except Hijackthis and click fix checked

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Run another Online scan please
http://www.ewido.net/en/onlinescan/

Once the scan completes,Save a report and then remove everything it finds.

Post the requested logs (from combofix, ewido log) and also tell me whats in this folder C:\Programmi\File comuni\Microsoft Shared also tell me what folders are in c:\Documents and Settings… Also make sure this folder is empty… C:\WINDOWS\Temp also post a new Hijackthis log.

Petauro

Post #5September 6, 2006, 10:14 PM UTC

combofix log

Sebastiano - 06-09-06 23.08.05,10
ComboFix 06.09.04BT - Running from: C:\Documents and Settings\[removed]\Desktop

Microsoft Windows XP [Versione 5.1.2600]

((((((((((((((((((((((((((((((( Files Created from 2006-08-06 to 2006-09-06 ))))))))))))))))))))))))))))))))))

2006-08-16 10:54 1,000,960 –a—— C:\WINDOWS\system32\esent.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-09-06 23:06 ——– d——– C:\Programmi\Mozilla Firefox
2006-09-06 21:23 ——– d——– C:\Programmi\AdunanzA
2006-09-06 19:24 ——– d——– C:\Programmi\File comuni\System
2006-09-05 12:12 ——– d——– C:\Programmi\Windows Media Player
2006-09-05 12:09 ——– d——– C:\Programmi\Outlook Express
2006-09-05 12:06 ——– d——– C:\Programmi\Messenger
2006-09-04 22:04 ——– d——– C:\Programmi\Kaspersky Lab
2006-09-01 20:00 ——– d—s—- C:\Documents and Settings\Sebastiano\Dati applicazioni\Microsoft
2006-08-15 22:20 ——– d——– C:\Documents and Settings\Sebastiano\Dati applicazioni\AdobeUM
2006-08-04 20:15 ——– d——– C:\Programmi\Last.fm
2006-07-21 10:32 72704 –a—— C:\WINDOWS\system32\hlink.dll
2006-07-19 20:52 ——– d——– C:\Documents and Settings\Sebastiano\Dati applicazioni\Adobe
2006-07-13 16:31 ——– d——– C:\Documents and Settings\Sebastiano\Dati applicazioni\Sun
2006-07-13 10:51 608256 –a—— C:\WINDOWS\system32\xpsp2res.dll
2006-07-12 21:48 ——– d——– C:\Programmi\Yahoo!
2006-07-12 21:48 ——– d——– C:\Programmi\Common Files
2006-07-12 16:22 ——– d——– C:\Documents and Settings\Sebastiano\Dati applicazioni\Talkback
2006-07-12 16:21 ——– d——– C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla
2006-07-12 15:21 ——– d–h—– C:\Programmi\WindowsUpdate
2006-07-12 13:00 ——– d——– C:\Programmi\eMule
2006-07-11 21:15 ——– d——– C:\Programmi\QuickTime
2006-07-11 21:15 ——– d——– C:\Programmi\Kodak
2006-07-11 21:15 ——– d——– C:\Programmi\File comuni\Kodak
2006-07-11 21:15 ——– d——– C:\Programmi\File comuni
2006-07-10 12:00 ——– d——– C:\Documents and Settings\Sebastiano\Dati applicazioni\Help
2006-07-06 22:33 ——– d——– C:\Documents and Settings\Sebastiano\Dati applicazioni\Ahead
2006-07-06 12:47 ——– d——– C:\Programmi\WinRAR
2006-07-05 17:03 0 –a—— C:\WINDOWS\system32\eraseme_63761.exe
2006-07-05 16:37 0 –a—— C:\WINDOWS\system32\eraseme_18706.exe
2006-07-03 17:17 0 -rahs—- C:\MSDOS.SYS
2006-07-03 17:17 0 -rahs—- C:\IO.SYS
2006-07-03 17:17 0 –a—— C:\CONFIG.SYS
2006-07-03 17:17 0 –a—— C:\AUTOEXEC.BAT
2006-07-03 17:15 62 –ahs—- C:\Documents and Settings\Sebastiano\Dati applicazioni\desktop.ini
2006-06-16 14:34 48936 –a—— C:\WINDOWS\system32\sirenacm.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"ATIPTA"="C:\\Programmi\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"HP Software Update"="\"C:\\Programmi\\HP\\HP Software Update\\HPWuSchd2.exe\""
"HP Component Manager"="\"C:\\Programmi\\HP\\hpcoretech\\hpcmpmgr.exe\""
@=""
"kav"="\"C:\\Programmi\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"MSMSGS"="\"C:\\Programmi\\Messenger\\msmsgs.exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonceex]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Pagina iniziale corrente"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,30,01,00,00,00,00,00,00,50,03,00,00,3e,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Kodak EasyShare software.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Avvio\\Programmi\\Esecuzione automatica\\Kodak EasyShare software.lnk"
"backup"="C:\\WINDOWS\\pss\\Kodak EasyShare software.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Kodak\\KODAKE~1\\bin\\EASYSH~1.EXE -h"
"item"="Kodak EasyShare software"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^KODAK Software Updater.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Avvio\\Programmi\\Esecuzione automatica\\KODAK Software Updater.lnk"
"backup"="C:\\WINDOWS\\pss\\KODAK Software Updater.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Kodak\\KODAKS~1\\7288971\\Program\\BACKWE~1.EXE "
"item"="KODAK Software Updater"

Completion time: 06/09/2006 23:08:50.00
ComboFix.txt

Ewido log

__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________

Name: TrackingCookie.Euroclick
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\0000008b.bak
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000a3.bak
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000a5.bak
Risk: Medium

Name: TrackingCookie.2o7
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000b0.bak
Risk: Medium

Name: TrackingCookie.Bluestreak
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000bb.bak
Risk: Medium

Name: TrackingCookie.2o7
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000bd.bak
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000bf.bak
Risk: Medium

Name: TrackingCookie.Adtech
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000c4.bak
Risk: Medium

Name: TrackingCookie.Tribalfusion
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000cd.bak
Risk: Medium

Name: TrackingCookie.Statcounter
Path: C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab\AVP6\PdmHist\ebc.3DC6929A01C6D1F8.history\000000dc.bak
Risk: Medium

Name: TrackingCookie.Adtech
Path: C:\Documents and Settings\Giovanna\Cookies\giovanna@adtech[2].txt
Risk: Medium

Name: TrackingCookie.Bluestreak
Path: C:\Documents and Settings\Giovanna\Cookies\giovanna@bluestreak[1].txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Giovanna\Cookies\[removed]-sys[2].txt
Risk: Medium

Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Giovanna\Cookies\giovanna@msnportal.112.2o7[1].txt
Risk: Medium

Name: TrackingCookie.Overture
Path: C:\Documents and Settings\Giovanna\Cookies\giovanna@overture[2].txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Giovanna\Cookies\giovanna@serving-sys[1].txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: C:\Documents and Settings\Giovanna\Cookies\giovanna@tradedoubler[1].txt
Risk: Medium

Name: TrackingCookie.Realtracker
Path: C:\Documents and Settings\Giovanna\Cookies\[removed][1].txt
Risk: Medium

Name: TrackingCookie.Smartadserver
Path: C:\Documents and Settings\Giovanna\Cookies\[removed][2].txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.22:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.23:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.24:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.25:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.26:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Statcounter
Path: :mozilla.27:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Atdmt
Path: :mozilla.64:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Falkag
Path: :mozilla.65:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.66:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.67:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.68:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.69:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: :mozilla.70:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Starware
Path: :mozilla.94:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Starware
Path: :mozilla.95:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Starware
Path: :mozilla.96:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.97:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.98:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Adbrite
Path: :mozilla.99:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Adbrite
Path: :mozilla.100:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Mediaplex
Path: :mozilla.102:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Mediaplex
Path: :mozilla.103:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.125:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.126:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Casalemedia
Path: :mozilla.152:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Revenue
Path: :mozilla.153:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Adtech
Path: :mozilla.166:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Adtech
Path: :mozilla.167:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.180:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Sitestat
Path: :mozilla.185:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Sitestat
Path: :mozilla.186:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Bluestreak
Path: :mozilla.202:C:\Documents and Settings\Giovanna\Dati applicazioni\Mozilla\Firefox\Profiles\s6vxoqv1.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.33:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.34:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Itrack
Path: :mozilla.45:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Falkag
Path: :mozilla.51:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Falkag
Path: :mozilla.52:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Falkag
Path: :mozilla.53:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Falkag
Path: :mozilla.54:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.55:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.56:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.57:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.58:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Starware
Path: :mozilla.64:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Starware
Path: :mozilla.65:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Starware
Path: :mozilla.66:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Starware
Path: :mozilla.67:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Mediaplex
Path: :mozilla.78:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.104:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.106:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.107:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.108:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.109:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.110:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: :mozilla.118:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Atdmt
Path: :mozilla.123:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Advertising
Path: :mozilla.149:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Advertising
Path: :mozilla.150:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Revenue
Path: :mozilla.155:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.201:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.202:C:\Documents and Settings\Sebastiano\Dati applicazioni\Mozilla\Firefox\Profiles\jdb23g3e.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@2o7[2].txt
Risk: Medium

Name: TrackingCookie.Adtech
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@adtech[2].txt
Risk: Medium

Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@advertising[1].txt
Risk: Medium

Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@atdmt[2].txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Yvonne\Cookies\[removed]-sys[2].txt
Risk: Medium

Name: TrackingCookie.Casalemedia
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@casalemedia[1].txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@doubleclick[2].txt
Risk: Medium

Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Yvonne\Cookies\[removed][1].txt
Risk: Medium

Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@hitbox[1].txt
Risk: Medium

Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@msnportal.112.2o7[1].txt
Risk: Medium

Name: TrackingCookie.Questionmarket
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@questionmarket[1].txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@serving-sys[2].txt
Risk: Medium

Name: TrackingCookie.Webtrendslive
Path: C:\Documents and Settings\Yvonne\Cookies\[removed][1].txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: C:\Documents and Settings\Yvonne\Cookies\yvonne@tradedoubler[1].txt
Risk: Medium

Name: TrackingCookie.Realtracker
Path: C:\Documents and Settings\Yvonne\Cookies\[removed][1].txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.6:C:\Documents and Settings\Yvonne\Dati applicazioni\Mozilla\Firefox\Profiles\21t676x9.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: :mozilla.12:C:\Documents and Settings\Yvonne\Dati applicazioni\Mozilla\Firefox\Profiles\21t676x9.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Ivwbox
Path: :mozilla.22:C:\Documents and Settings\Yvonne\Dati applicazioni\Mozilla\Firefox\Profiles\21t676x9.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Casalemedia
Path: :mozilla.27:C:\Documents and Settings\Yvonne\Dati applicazioni\Mozilla\Firefox\Profiles\21t676x9.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Advertising
Path: :mozilla.28:C:\Documents and Settings\Yvonne\Dati applicazioni\Mozilla\Firefox\Profiles\21t676x9.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Advertising
Path: :mozilla.29:C:\Documents and Settings\Yvonne\Dati applicazioni\Mozilla\Firefox\Profiles\21t676x9.default\cookies.txt
Risk: Medium

C:\Programmi\File comuni\Microsoft Shared
C:\Programmi\File comuni\Microsoft Shared\CDO
C:\Programmi\File comuni\Microsoft Shared\DAO
C:\Programmi\File comuni\Microsoft Shared\dasetup
C:\Programmi\File comuni\Microsoft Shared\Dashboard Components
C:\Programmi\File comuni\Microsoft Shared\Database Replication
C:\Programmi\File comuni\Microsoft Shared\DW
C:\Programmi\File comuni\Microsoft Shared\Elementi decorativi
C:\Programmi\File comuni\Microsoft Shared\Equation
C:\Programmi\File comuni\Microsoft Shared\Euro
C:\Programmi\File comuni\Microsoft Shared\Grphflt
C:\Programmi\File comuni\Microsoft Shared\Information Retrieval
C:\Programmi\File comuni\Microsoft Shared\MSClientDataMgr
C:\Programmi\File comuni\Microsoft Shared\MSDesigners7
C:\Programmi\File comuni\Microsoft Shared\MSDraw
C:\Programmi\File comuni\Microsoft Shared\MSEnv
C:\Programmi\File comuni\Microsoft Shared\MSInfo
C:\Programmi\File comuni\Microsoft Shared\MSORun
C:\Programmi\File comuni\Microsoft Shared\MSPaper
C:\Programmi\File comuni\Microsoft Shared\MSSearch
C:\Programmi\File comuni\Microsoft Shared\Office10
C:\Programmi\File comuni\Microsoft Shared\OrgChart
C:\Programmi\File comuni\Microsoft Shared\PhotoEd
C:\Programmi\File comuni\Microsoft Shared\Proof
C:\Programmi\File comuni\Microsoft Shared\Reference Titles
C:\Programmi\File comuni\Microsoft Shared\Smart Tag
C:\Programmi\File comuni\Microsoft Shared\Snapshot Viewer
C:\Programmi\File comuni\Microsoft Shared\Speech
C:\Programmi\File comuni\Microsoft Shared\TextConv
C:\Programmi\File comuni\Microsoft Shared\Themes
C:\Programmi\File comuni\Microsoft Shared\Translat
C:\Programmi\File comuni\Microsoft Shared\Triedit
C:\Programmi\File comuni\Microsoft Shared\VBA
C:\Programmi\File comuni\Microsoft Shared\VGX
C:\Programmi\File comuni\Microsoft Shared\Visual Database Tools
C:\Programmi\File comuni\Microsoft Shared\VS7Debug
C:\Programmi\File comuni\Microsoft Shared\Web Components
C:\Programmi\File comuni\Microsoft Shared\Web Folders
C:\Programmi\File comuni\Microsoft Shared\web server extensions

C:\Documents and Settings
C:\Documents and Settings\Administrator
C:\Documents and Settings\All Users
C:\Documents and Settings\Default User
C:\Documents and Settings\Giovanna
C:\Documents and Settings\Sebastiano
C:\Documents and Settings\Stefano
C:\Documents and Settings\Yvonne

C:\WINDOWS\Temp is not empy: there is ONLY a file, ~DFBCFD.tmp, that I can' t delete…

HIJACKTHIS LOG

Logfile of HijackThis v1.99.1
Scan saved at 23.59.42, on 06/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Sebastiano\Impostazioni locali\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/Default.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [kav] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O12 - Plugin for .mov: C:\Programmi\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://yvy91yvonne.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

therock247uk

Post #6September 6, 2006, 11:30 PM UTC

Download RegSupreme Pro 1.1.0.32
http://majorgeeks.com/RegSupreme_Pro_d4256.html

Once downloaded and launched,Click Yes to Update the Cache-> Click "Registry Cleaner"-> Click "Aggresive" and "Start"-> Fix everything it finds-> Name the Backup it creates and Save it somewhere safe.

I see you have Kaspersky update it and do a full scan with it locate a report if you can of what it finds and post it here in a reply it may need to be attached as it may be big…

Petauro

Post #7September 8, 2006, 11:16 AM UTC

Kaspersky didn' t find anything… sometimes it tells me that there' s Svchost.exe on "function call of buffer overdun" (sorry but i can' t explain better… i have kaspersky in italian and i'm not able to translate very well) in my task manager there is 6 process "svchost.exe"…

therock247uk

Post #8September 8, 2006, 1:45 PM UTC

in my task manager there is 6 process "svchost.exe"…

Is normal…

Post a new Hijackthis log here in a reply.

Petauro

Post #9September 8, 2006, 4:42 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 18.31.56, on 08/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Sebastiano\Impostazioni locali\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/Default.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [kav] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O12 - Plugin for .mov: C:\Programmi\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://yvy91yvonne.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

therock247uk

Post #10September 8, 2006, 8:52 PM UTC last edited September 8, 2006, 8:52 PM UTC

1. Launch Notepad, and copy/paste the contents of the quote box below into a new Notepad file. Save it with file name options.txt and save as file type: all files to your desktop.

RegSearch Options File

[Search]
A60E1174-F5C6-2FC0-1BB2-328964BA8F56
khcwg1.dll

[Exclude]

[Options]
Filter=KVDLUI

2. Download Registry Search to your desktop.

Right click on the compressed RegSearch folder, and choose "Extract All". In the box that pops open, click "Next", then "Next" again, and then "Finish". You now have another RegSearch folder on your desktop.
Open the new folder, and double click on regsearch.exe
Click "Import" in the lower left corner and browse to the options.txt file that you just saved on your desktop. Do not choose the one in the RegSearch folder itself.
Click OK and Registry Search will scan your registry for the file(s), and a Notepad box will open with a report.
Please reply here with the entire contents of the Notepad file from RegSearch.

Petauro

Post #11September 9, 2006, 10:09 AM UTC

REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 09/09/2006 11.58.54 for strings: ; 'a60e1174-f5c6-2fc0-1bb2-328964ba8f56' ; 'khcwg1.dll' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks] "{A60E1174-F5C6-2FC0-1BB2-328964BA8F56}"="" ; End Of The Log…

therock247uk

Post #12September 9, 2006, 10:39 PM UTC

Copy and paste the following into notepad

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{A60E1174-F5C6-2FC0-1BB2-328964BA8F56}"=-

Save it as fix.reg as type all files to the desktop then go to the desktop and run it it will ask to merge into the registery say yes.

Run RegSupreme Pro again like you did before.

Then post a new Hijackthis log here in a reply.

Petauro

Post #13September 10, 2006, 2:32 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 16.21.36, on 10/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Sebastiano\Impostazioni locali\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/Default.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [kav] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O12 - Plugin for .mov: C:\Programmi\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://yvy91yvonne.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

therock247uk

Post #14September 10, 2006, 4:28 PM UTC

Your log is clean.

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

Detect and Remove Programs:

How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

Prevention Programs:

Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Google Toolbar <= Get the free google toolbar to help stop pop up windows.
I also suggest that you delete any files from "temp", "tmp" folders. In Internet Explorer, click on "Tools" => "Internet Options" => "Delete Files" and select the box that says "Delete All Offline Content" and click on "OK" twice. Also, empty the recycle bin by right clicking on it and selecting "Empty Recycle Bin". These steps should be done on a regular basis.

Other necessary Programs:

AntiVirus Program<= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kapersky, this is a must have.
Firewall<= A firewall is definatley a must have. Three good free versions are Kerio, Sygate and ZoneLabs.

little eagle

Post #15February 4, 2007, 12:33 AM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

mmm... Link Opzimizer or...?

✨ Ask AI

Ask AI