bvoges
Topic Starter
don't know how to attach a file so am just pasting in the text of the log files.
these are from my wife's computer, which was badly hit with malware last Friday.
unfortunately, I mistakenly ran ewido in safe mode with networking, not regular safe mode.
have tried running ewido in regular safe mode, but it fails with the error "Something bad happened in the application. Error diagnostic file saved to <path>"
i have tried uninstalling and reinstalling ewido and still get the same error. I suspect that possibly I screwed up by responding incorrectly to a spybot resident message alerting me to a registry change involving ewido, but am not sure how to clean this up.
in any case, I hope the logs are helpful and appreciate any advice
here is the ewido logfile from when i ran it in safe mode with networking:
___________________
———————————————————
ewido anti-spyware - Scan Report
———————————————————
+ Created at: 9:44:13 AM 9/6/2006
+ Scan result:
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\O12FG5IJ\AppWrap[1].exe -> Adware.AdURL : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\thiselt[2].exe -> Adware.Agent : Cleaned with backup (quarantined).
C:\Program Files\Common Files\{15531503-031D-1033-0301-020322000001}\Update.exe -> Adware.Agent : Cleaned with backup (quarantined).
C:\Program Files\Mіcrosoft\spool32.exe -> Adware.ClickSpring : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\drsmartload180a.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined).
C:\dfndrff_15.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\temp.fr13CB -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\k680lglm16qa.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\qeartz.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\qwartz.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\r2r6lc9s1f.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
[628] C:\WINNT\system32\miexch40.dll -> Adware.Look2Me : Error during cleaning.
[720] C:\WINNT\system32\miexch40.dll -> Adware.Look2Me : Error during cleaning.
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD3.tmp\amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\09ER0XE3\joysavsht[1].cab/amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\amm06[1].ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\em[1].ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\mediaview[1].cab/amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\mmxsnet.exe -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GL456P4V\em[1].ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINNT\amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINNT\em.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINNT\unstall.exe -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINNT\mtuninst.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\vzbb.dll -> Adware.MegaSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\NNBar_VCSetup_876075.exe -> Adware.Mirar : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\mit4B.tmp.cab/NNBar_VCSetup_876075.exe -> Adware.Mirar : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\mit4B.tmp/NNBar_VCSetup_876075.exe -> Adware.Mirar : Cleaned with backup (quarantined).
C:\WINNT\system32\WinNB58.dll -> Adware.Mirar : Cleaned with backup (quarantined).
C:\Program Files\PSLister\PSLister.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\BundleInstall.exe -> Adware.Relevant : Cleaned with backup (quarantined).
C:\WINNT\MirarSetup_876075.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Deskbar\deskbar.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\daAF.tmp -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\TIGEN001[1].exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\TIGEN001.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\Mary's old computer\Program Files\Netscape\Netscape 6\defaults\profile\od-teen171.exe -> Dialer.eConnect : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\3138302D2D2D[1].exe -> Downloader.Adload.aj : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\drsmartload125a.exe -> Downloader.Adload.ep : Cleaned with backup (quarantined).
C:\WINNT\system32\dmonwv.dll_tobedeleted -> Downloader.Agent.agw : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\topaff[1].exe -> Downloader.Agent.aqx : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ajdnjhfo9.exe -> Downloader.Agent.aqx : Cleaned with backup (quarantined).
C:\topaff.exe -> Downloader.Agent.aqx : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\ac3[1].txt -> Downloader.Agent.awb : Cleaned with backup (quarantined).
C:\WINNT\system32\aaa00000.dll -> Downloader.Agent.awb : Cleaned with backup (quarantined).
C:\WINNT\system32\oefd6f53.dll -> Downloader.Agent.awb : Cleaned with backup (quarantined).
C:\WINNT\csvhost.exe -> Downloader.Agent.xq : Cleaned with backup (quarantined).
C:\WINNT\optimize.exe -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined).
C:\WINNT\srvqqfrsne.exe -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined).
C:\814.exe -> Downloader.Dyfuca.fb : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\drsmartload_js[1].html -> Downloader.IstBar.j : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\09ER0XE3\installerwnus[1].exe -> Downloader.Qoologic.at : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\awxvn.exe -> Downloader.Qoologic.bj : Cleaned with backup (quarantined).
C:\WINNT\system32\nmbxs.dat -> Downloader.Qoologic.bj : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\al3[1].txt -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\mtrslib2[1].js -> Downloader.Small.ag : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\idlemg[1].exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\WINNT\idlemg.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\ac3_0003[1].exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\ac3_0002[2].exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\WINNT\ac3_0002.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\ac3_0003.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\09ER0XE3\ld_hng4[1].exe -> Downloader.Small.dlw : Cleaned with backup (quarantined).
C:\WINNT\system32\dxvwctzl.exe -> Downloader.Small.dlw : Cleaned with backup (quarantined).
C:\Program Files\Common Files\uqfo\uqfop.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
C:\Program Files\Common Files\uqfo\uqfoa.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
C:\Program Files\Common Files\misc002\141.exe -> Downloader.TSUpdate.o : Cleaned with backup (quarantined).
C:\Program Files\Common Files\uqfo\uqfol.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\09ER0XE3\loader[1].exe -> Downloader.VB.agk : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\drsmartload[1].exe -> Downloader.VB.agk : Cleaned with backup (quarantined).
C:\kybrdff_15.exe -> Downloader.VB.alg : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\drsmartload45a[1].exe -> Downloader.VB.alt : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\drsmartload46a[1].exe -> Downloader.VB.alt : Cleaned with backup (quarantined).
C:\WINNT\azfoziqA.exe -> Downloader.VB.alu : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\VZJGVN7I\kybrdff_16[1].exe -> Downloader.VB.amb : Cleaned with backup (quarantined).
C:\kybrdff_16.exe -> Downloader.VB.amb : Cleaned with backup (quarantined).
C:\WINNT\offun.exe -> Downloader.VB.nw : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\xload.exe -> Downloader.VB.wz : Cleaned with backup (quarantined).
C:\803_104.exe -> Dropper.Mudrop.bq : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\803_104[1].exe -> Dropper.Mudrop.bq : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\MediaTicketsInstaller[1].cab/MediaTicketsInstaller.ocx -> Dropper.PurityScan.ae : Cleaned with backup (quarantined).
C:\SS1001newer.exe -> Dropper.Small.qn : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Desktop\TagASaurus.exe -> Hijacker.Small : Cleaned with backup (quarantined).
C:\Recycled\Dc13.exe -> Hijacker.Small : Cleaned with backup (quarantined).
C:\Program Files\Windows NT\rymekyh.html -> Hijacker.Small.jf : Cleaned with backup (quarantined).
C:\Program Files\microsoft frontpage\pokyhofob.html -> Hijacker.Small.jf : Cleaned with backup (quarantined).
C:\WINNT\azfoziq.exe -> Hijacker.VB.ij : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\SystemDoctor2006FreeInstall[1].cab/USDR6_0001_D08M0404NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Ignored.
C:\WINNT\system32\stonedrv.exe -> Proxy.Small.bo : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@buildabear.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@gettyimages.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@marketlive.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@maxis.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@nbcuniversal.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@ning.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@snapfish.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\administrator@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@admarketplace[2].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@admarketplace[3].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Adtrak : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][4].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][5].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@burstnet[4].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@burstnet[5].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Enigmasoftwaregroup : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@hypertracker[1].txt -> TrackingCookie.Hypertracker : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@hypertracker[2].txt -> TrackingCookie.Hypertracker : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@hypertracker[3].txt -> TrackingCookie.Hypertracker : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Realcastmedia : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.10:C:\Mary's old computer\Documents and Settings\administrator\Application Data\Mozilla\Profiles\default\amvy9388.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Searchingbooth : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Searchingbooth : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][4].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Specificpop : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\administrator@specificpop[2].txt -> TrackingCookie.Specificpop : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@starware[4].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[3].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed]-banners[1].txt -> TrackingCookie.Top-banners : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\administrator@webstat[1].txt -> TrackingCookie.Web-stat : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed]-stat[1].txt -> TrackingCookie.Web-stat : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\msn.exe -> Trojan.Sinowal.aq : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll -> Trojan.Sinowal.aq : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll -> Trojan.Sinowal.aq : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\DH2YEUCT\rogue[1].exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Gjvf\Yizanue.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Rxnnq\Hgclo.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\WINNT\uni_ehhhh.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).
C:\WINNT\uninst104.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).
::Report end
___________________
here is the HijackThis log:
___________________
Logfile of HijackThis v1.99.1
Scan saved at 9:57:49 AM, on 9/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\system32\cmd.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;local.,
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINNT\system32\xydyg.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,jtjdryv.exe
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINNT\DOWNLO~1\vzbb.dll (file missing)
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [A Verizon App] C:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [TheMonitor] C:\WINNT\Duce6.exe
O4 - HKLM\..\Run: [hgpmgr] C:\WINNT\system32\iplugt.exe reg_run
O4 - HKLM\..\Run: [oefd6f53] RUNDLL32.EXE w060a092.dll,n 003d6f5000000003060a092
O4 - HKLM\..\Run: [sys09357766403] C:\WINNT\sys09357766403.exe
O4 - HKLM\..\Run: [OSS] C:\winnt\system32\rk.exe -boot
O4 - HKLM\..\Run: [pop06ap] C:\WINNT\pop06ap2.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINNT\system32\nwinkpex.exe GEN001
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [ntdll.dll] C:\WINNT\system32\iplugt.exe reg_run
O4 - HKLM\..\Run: [xload] "C:\WINNT\xload.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [My Web Search Community Tools] "C:\Program Files\MyWebSearch\bar\2.bin\m3IMPipe.exe"
O4 - HKCU\..\Run: [uqfo] C:\PROGRA~1\COMMON~1\uqfo\uqfom.exe
O4 - HKCU\..\Run: [edwnh] C:\WINNT\system32\iplugt.exe reg_run
O4 - HKCU\..\Run: [cprocsvc] C:\WINNT\system32\crunner\cproc.exe
O4 - HKCU\..\Run: [Bss] C:\Program Files\S?mantec\r?ndll.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: UMAX VistaAccess.lnk = C:\VSTASCAN\vsaccess.exe
O4 - Startup: TA_Start.lnk = C:\TIGEN001.exe
O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: &Google; Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search; - http://edits.mywebsearch.com/toolbaredits/…?p=ZNxmk121CSUS
O8 - Extra context menu item: &Translate; English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.sxload.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…oad/tgctlcm.cab
O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
O20 - Winlogon Notify: Internet Settings - C:\WINNT\system32\enn8l15u1.dll
O20 - Winlogon Notify: yvdrgb - yvdrgb.dll (file missing)
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
___________________
Here is the ewido.err diagnostic file:
___________________
//=====================================
Exception code: C0000005 ACCESS_VIOLATION
Fault address: 00426DD6 01:00025DD6 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
Module Date: 06/16/2006 07:39:05
File Version of C:\Program Files\ewido anti-spyware 4.0\ewido.exe: 4.0.0.172
Exception Date: 09/06/2006 09:59:34
Registers:
EAX:0012E32C
EBX:01370BF0
ECX:0012E344
EDX:DFBF0001
ESI:77E139A2
EDI:014F3000
CS:EIP:001B:00426DD6
SS:ESP:0023:0012E1F8 EBP:0012E38C
DS:0023 ES:0023 FS:003B GS:0000
Flags:00010246
Intel specific method
Call stack:
Address Frame Param 0 Param 1 Param 2 Param 3 Logical addr Module
00426DD6 0012E38C 00013606 0012E3B8 00000000 01370BF0 0001:00025DD6 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
00427B42 0012E3D4 0012E990 00000001 00010098 50000000 0001:00026B42 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
004280DA 0012E468 0012E5F4 77E1343F 00010090 00000005 0001:000270DA C:\Program Files\ewido anti-spyware 4.0\ewido.exe
77E139E5 0012E488 00010090 00000005 00000000 014402C4 0001:000029E5 C:\WINNT\system32\USER32.DLL
ImageHelp specific method
Call stack:
Address Frame Param 0 Param 1 Param 2 Param 3 Symbol/Logical address
00426DD6 0012E38C 00013606 0012E3B8 00000000 01370BF0 0001:00025DD6 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
00427B42 0012E3D4 0012E990 00000001 00010098 50000000 0001:00026B42 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
004280DA 0012E468 0012E5F4 77E1343F 00010090 00000005 0001:000270DA C:\Program Files\ewido anti-spyware 4.0\ewido.exe
77E139E5 0012E488 00010090 00000005 00000000 014402C4 SendMessageW+43
Loaded Modules:
Base Size Module
00400000 609000 4.00.0000.0172 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
77F80000 07D000 5.00.2195.6899 C:\WINNT\system32\ntdll.dll
690A0000 00B000 5.00.2134.0001 C:\WINNT\system32\PSAPI.DLL
7C570000 0B8000 5.00.2195.6897 C:\WINNT\system32\KERNEL32.DLL
10000000 0E3000 4.00.0000.0172 C:\Program Files\ewido anti-spyware 4.0\engine.dll
70A70000 064000 6.00.2800.1552 C:\WINNT\system32\SHLWAPI.dll
78000000 045000 6.01.9844.0000 C:\WINNT\system32\msvcrt.dll
77F40000 03E000 5.00.2195.6898 C:\WINNT\system32\GDI32.dll
77E10000 065000 5.00.2195.6897 C:\WINNT\system32\USER32.DLL
7C2D0000 062000 5.00.2195.6876 C:\WINNT\system32\ADVAPI32.dll
77D30000 071000 5.00.2195.6904 C:\WINNT\system32\RPCRT4.DLL
75030000 014000 5.00.2195.6601 C:\WINNT\system32\WS2_32.dll
75020000 008000 5.00.2134.0001 C:\WINNT\system32\WS2HELP.DLL
77570000 030000 5.00.2161.0001 C:\WINNT\system32\WINMM.dll
782F0000 245000 5.00.3900.6922 C:\WINNT\system32\SHELL32.dll
71710000 084000 5.81.4916.0400 C:\WINNT\system32\COMCTL32.dll
6B2C0000 005000 5.00.2180.0001 C:\WINNT\system32\MSIMG32.dll
76B30000 03E000 5.00.3700.6693 C:\WINNT\system32\comdlg32.dll
77A50000 0EF000 5.00.2195.6906 C:\WINNT\system32\ole32.dll
75050000 008000 5.00.2195.6603 C:\WINNT\system32\WSOCK32.dll
77340000 013000 5.00.2195.6602 C:\WINNT\system32\iphlpapi.dll
77520000 005000 5.00.2134.0001 C:\WINNT\system32\ICMP.DLL
77320000 017000 5.00.2181.0001 C:\WINNT\system32\MPRAPI.DLL
75150000 00F000 5.00.2195.6897 C:\WINNT\system32\SAMLIB.DLL
75170000 04F000 5.00.2195.6949 C:\WINNT\system32\NETAPI32.DLL
7C340000 00F000 5.00.2195.6695 C:\WINNT\system32\Secur32.dll
77BF0000 011000 5.00.2195.6666 C:\WINNT\system32\NTDSAPI.dll
77980000 024000 5.00.2195.6824 C:\WINNT\system32\DNSAPI.DLL
77950000 02A000 5.00.2195.6666 C:\WINNT\system32\WLDAP32.DLL
751C0000 006000 5.00.2134.0001 C:\WINNT\system32\NETRAP.dll
779B0000 09B000 2.40.4522.0000 C:\WINNT\system32\OLEAUT32.DLL
773B0000 02F000 5.00.2195.6601 C:\WINNT\system32\ACTIVEDS.DLL
77380000 023000 5.00.2195.6701 C:\WINNT\system32\ADSLDPC.DLL
77830000 00E000 5.00.2168.0001 C:\WINNT\system32\RTUTILS.DLL
77880000 08E000 5.00.2195.6622 C:\WINNT\system32\SETUPAPI.DLL
7C0F0000 061000 5.00.2195.6794 C:\WINNT\system32\USERENV.DLL
774E0000 033000 5.00.2195.6625 C:\WINNT\system32\RASAPI32.DLL
774C0000 011000 5.00.2195.6738 C:\WINNT\system32\RASMAN.DLL
77530000 022000 5.00.2195.6664 C:\WINNT\system32\TAPI32.DLL
77360000 019000 5.00.2195.6685 C:\WINNT\system32\DHCPCSVC.DLL
77820000 007000 5.00.2195.6623 C:\WINNT\system32\VERSION.dll
759B0000 006000 5.00.2195.6611 C:\WINNT\system32\LZ32.DLL
75E60000 01A000 5.00.2195.6655 C:\WINNT\system32\IMM32.DLL
775A0000 090000 2000.02.3511.0000 C:\WINNT\system32\CLBCATQ.DLL
77840000 03E000 5.00.2195.6705 C:\WINNT\system32\cscui.dll
770C0000 023000 5.00.2195.6713 C:\WINNT\system32\CSCDLL.DLL
72A00000 02D000 5.00.2195.6613 C:\WINNT\system32\DBGHELP.DLL
___________________
these are from my wife's computer, which was badly hit with malware last Friday.
unfortunately, I mistakenly ran ewido in safe mode with networking, not regular safe mode.
have tried running ewido in regular safe mode, but it fails with the error "Something bad happened in the application. Error diagnostic file saved to <path>"
i have tried uninstalling and reinstalling ewido and still get the same error. I suspect that possibly I screwed up by responding incorrectly to a spybot resident message alerting me to a registry change involving ewido, but am not sure how to clean this up.
in any case, I hope the logs are helpful and appreciate any advice
here is the ewido logfile from when i ran it in safe mode with networking:
___________________
———————————————————
ewido anti-spyware - Scan Report
———————————————————
+ Created at: 9:44:13 AM 9/6/2006
+ Scan result:
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\O12FG5IJ\AppWrap[1].exe -> Adware.AdURL : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\thiselt[2].exe -> Adware.Agent : Cleaned with backup (quarantined).
C:\Program Files\Common Files\{15531503-031D-1033-0301-020322000001}\Update.exe -> Adware.Agent : Cleaned with backup (quarantined).
C:\Program Files\Mіcrosoft\spool32.exe -> Adware.ClickSpring : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\drsmartload180a.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined).
C:\dfndrff_15.exe -> Adware.DollarRevenue : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\temp.fr13CB -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\k680lglm16qa.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\qeartz.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\qwartz.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\r2r6lc9s1f.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
[628] C:\WINNT\system32\miexch40.dll -> Adware.Look2Me : Error during cleaning.
[720] C:\WINNT\system32\miexch40.dll -> Adware.Look2Me : Error during cleaning.
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD3.tmp\amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\09ER0XE3\joysavsht[1].cab/amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\amm06[1].ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\em[1].ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\mediaview[1].cab/amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\mmxsnet.exe -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GL456P4V\em[1].ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINNT\amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINNT\em.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINNT\unstall.exe -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WINNT\mtuninst.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\vzbb.dll -> Adware.MegaSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\NNBar_VCSetup_876075.exe -> Adware.Mirar : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\mit4B.tmp.cab/NNBar_VCSetup_876075.exe -> Adware.Mirar : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\mit4B.tmp/NNBar_VCSetup_876075.exe -> Adware.Mirar : Cleaned with backup (quarantined).
C:\WINNT\system32\WinNB58.dll -> Adware.Mirar : Cleaned with backup (quarantined).
C:\Program Files\PSLister\PSLister.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\BundleInstall.exe -> Adware.Relevant : Cleaned with backup (quarantined).
C:\WINNT\MirarSetup_876075.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Deskbar\deskbar.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\daAF.tmp -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\TIGEN001[1].exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\TIGEN001.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\Mary's old computer\Program Files\Netscape\Netscape 6\defaults\profile\od-teen171.exe -> Dialer.eConnect : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\3138302D2D2D[1].exe -> Downloader.Adload.aj : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\drsmartload125a.exe -> Downloader.Adload.ep : Cleaned with backup (quarantined).
C:\WINNT\system32\dmonwv.dll_tobedeleted -> Downloader.Agent.agw : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\topaff[1].exe -> Downloader.Agent.aqx : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ajdnjhfo9.exe -> Downloader.Agent.aqx : Cleaned with backup (quarantined).
C:\topaff.exe -> Downloader.Agent.aqx : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\ac3[1].txt -> Downloader.Agent.awb : Cleaned with backup (quarantined).
C:\WINNT\system32\aaa00000.dll -> Downloader.Agent.awb : Cleaned with backup (quarantined).
C:\WINNT\system32\oefd6f53.dll -> Downloader.Agent.awb : Cleaned with backup (quarantined).
C:\WINNT\csvhost.exe -> Downloader.Agent.xq : Cleaned with backup (quarantined).
C:\WINNT\optimize.exe -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined).
C:\WINNT\srvqqfrsne.exe -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined).
C:\814.exe -> Downloader.Dyfuca.fb : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\drsmartload_js[1].html -> Downloader.IstBar.j : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\09ER0XE3\installerwnus[1].exe -> Downloader.Qoologic.at : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\awxvn.exe -> Downloader.Qoologic.bj : Cleaned with backup (quarantined).
C:\WINNT\system32\nmbxs.dat -> Downloader.Qoologic.bj : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\al3[1].txt -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\mtrslib2[1].js -> Downloader.Small.ag : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\idlemg[1].exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\WINNT\idlemg.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\ac3_0003[1].exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\ac3_0002[2].exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\WINNT\ac3_0002.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\ac3_0003.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\09ER0XE3\ld_hng4[1].exe -> Downloader.Small.dlw : Cleaned with backup (quarantined).
C:\WINNT\system32\dxvwctzl.exe -> Downloader.Small.dlw : Cleaned with backup (quarantined).
C:\Program Files\Common Files\uqfo\uqfop.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
C:\Program Files\Common Files\uqfo\uqfoa.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
C:\Program Files\Common Files\misc002\141.exe -> Downloader.TSUpdate.o : Cleaned with backup (quarantined).
C:\Program Files\Common Files\uqfo\uqfol.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\09ER0XE3\loader[1].exe -> Downloader.VB.agk : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\0LMB81QZ\drsmartload[1].exe -> Downloader.VB.agk : Cleaned with backup (quarantined).
C:\kybrdff_15.exe -> Downloader.VB.alg : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\drsmartload45a[1].exe -> Downloader.VB.alt : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\WPYJKX2J\drsmartload46a[1].exe -> Downloader.VB.alt : Cleaned with backup (quarantined).
C:\WINNT\azfoziqA.exe -> Downloader.VB.alu : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\VZJGVN7I\kybrdff_16[1].exe -> Downloader.VB.amb : Cleaned with backup (quarantined).
C:\kybrdff_16.exe -> Downloader.VB.amb : Cleaned with backup (quarantined).
C:\WINNT\offun.exe -> Downloader.VB.nw : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\xload.exe -> Downloader.VB.wz : Cleaned with backup (quarantined).
C:\803_104.exe -> Dropper.Mudrop.bq : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\803_104[1].exe -> Dropper.Mudrop.bq : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\MediaTicketsInstaller[1].cab/MediaTicketsInstaller.ocx -> Dropper.PurityScan.ae : Cleaned with backup (quarantined).
C:\SS1001newer.exe -> Dropper.Small.qn : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Desktop\TagASaurus.exe -> Hijacker.Small : Cleaned with backup (quarantined).
C:\Recycled\Dc13.exe -> Hijacker.Small : Cleaned with backup (quarantined).
C:\Program Files\Windows NT\rymekyh.html -> Hijacker.Small.jf : Cleaned with backup (quarantined).
C:\Program Files\microsoft frontpage\pokyhofob.html -> Hijacker.Small.jf : Cleaned with backup (quarantined).
C:\WINNT\azfoziq.exe -> Hijacker.VB.ij : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DAN4D6J\SystemDoctor2006FreeInstall[1].cab/USDR6_0001_D08M0404NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Ignored.
C:\WINNT\system32\stonedrv.exe -> Proxy.Small.bo : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@buildabear.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@gettyimages.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@marketlive.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@maxis.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@nbcuniversal.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@ning.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@snapfish.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\administrator@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@admarketplace[2].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@admarketplace[3].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Adtrak : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][4].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][5].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@burstnet[4].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@burstnet[5].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Enigmasoftwaregroup : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@hypertracker[1].txt -> TrackingCookie.Hypertracker : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@hypertracker[2].txt -> TrackingCookie.Hypertracker : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@hypertracker[3].txt -> TrackingCookie.Hypertracker : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Realcastmedia : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.10:C:\Mary's old computer\Documents and Settings\administrator\Application Data\Mozilla\Profiles\default\amvy9388.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Searchingbooth : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Searchingbooth : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][4].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed][1].txt -> TrackingCookie.Specificpop : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\administrator@specificpop[2].txt -> TrackingCookie.Specificpop : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@starware[4].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[3].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed]-banners[1].txt -> TrackingCookie.Top-banners : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\administrator@webstat[1].txt -> TrackingCookie.Web-stat : Cleaned.
C:\Mary's old computer\Documents and Settings\administrator\Cookies\[removed]-stat[1].txt -> TrackingCookie.Web-stat : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\msn.exe -> Trojan.Sinowal.aq : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll -> Trojan.Sinowal.aq : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll -> Trojan.Sinowal.aq : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\DH2YEUCT\rogue[1].exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Gjvf\Yizanue.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\Program Files\Rxnnq\Hgclo.exe -> Trojan.Small.cy : Cleaned with backup (quarantined).
C:\WINNT\uni_ehhhh.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).
C:\WINNT\uninst104.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).
::Report end
___________________
here is the HijackThis log:
___________________
Logfile of HijackThis v1.99.1
Scan saved at 9:57:49 AM, on 9/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\system32\cmd.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;local.,
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINNT\system32\xydyg.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,jtjdryv.exe
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINNT\DOWNLO~1\vzbb.dll (file missing)
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [A Verizon App] C:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [TheMonitor] C:\WINNT\Duce6.exe
O4 - HKLM\..\Run: [hgpmgr] C:\WINNT\system32\iplugt.exe reg_run
O4 - HKLM\..\Run: [oefd6f53] RUNDLL32.EXE w060a092.dll,n 003d6f5000000003060a092
O4 - HKLM\..\Run: [sys09357766403] C:\WINNT\sys09357766403.exe
O4 - HKLM\..\Run: [OSS] C:\winnt\system32\rk.exe -boot
O4 - HKLM\..\Run: [pop06ap] C:\WINNT\pop06ap2.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINNT\system32\nwinkpex.exe GEN001
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [ntdll.dll] C:\WINNT\system32\iplugt.exe reg_run
O4 - HKLM\..\Run: [xload] "C:\WINNT\xload.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [My Web Search Community Tools] "C:\Program Files\MyWebSearch\bar\2.bin\m3IMPipe.exe"
O4 - HKCU\..\Run: [uqfo] C:\PROGRA~1\COMMON~1\uqfo\uqfom.exe
O4 - HKCU\..\Run: [edwnh] C:\WINNT\system32\iplugt.exe reg_run
O4 - HKCU\..\Run: [cprocsvc] C:\WINNT\system32\crunner\cproc.exe
O4 - HKCU\..\Run: [Bss] C:\Program Files\S?mantec\r?ndll.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: UMAX VistaAccess.lnk = C:\VSTASCAN\vsaccess.exe
O4 - Startup: TA_Start.lnk = C:\TIGEN001.exe
O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: &Google; Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search; - http://edits.mywebsearch.com/toolbaredits/…?p=ZNxmk121CSUS
O8 - Extra context menu item: &Translate; English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.sxload.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…oad/tgctlcm.cab
O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
O20 - Winlogon Notify: Internet Settings - C:\WINNT\system32\enn8l15u1.dll
O20 - Winlogon Notify: yvdrgb - yvdrgb.dll (file missing)
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
___________________
Here is the ewido.err diagnostic file:
___________________
//=====================================
Exception code: C0000005 ACCESS_VIOLATION
Fault address: 00426DD6 01:00025DD6 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
Module Date: 06/16/2006 07:39:05
File Version of C:\Program Files\ewido anti-spyware 4.0\ewido.exe: 4.0.0.172
Exception Date: 09/06/2006 09:59:34
Registers:
EAX:0012E32C
EBX:01370BF0
ECX:0012E344
EDX:DFBF0001
ESI:77E139A2
EDI:014F3000
CS:EIP:001B:00426DD6
SS:ESP:0023:0012E1F8 EBP:0012E38C
DS:0023 ES:0023 FS:003B GS:0000
Flags:00010246
Intel specific method
Call stack:
Address Frame Param 0 Param 1 Param 2 Param 3 Logical addr Module
00426DD6 0012E38C 00013606 0012E3B8 00000000 01370BF0 0001:00025DD6 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
00427B42 0012E3D4 0012E990 00000001 00010098 50000000 0001:00026B42 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
004280DA 0012E468 0012E5F4 77E1343F 00010090 00000005 0001:000270DA C:\Program Files\ewido anti-spyware 4.0\ewido.exe
77E139E5 0012E488 00010090 00000005 00000000 014402C4 0001:000029E5 C:\WINNT\system32\USER32.DLL
ImageHelp specific method
Call stack:
Address Frame Param 0 Param 1 Param 2 Param 3 Symbol/Logical address
00426DD6 0012E38C 00013606 0012E3B8 00000000 01370BF0 0001:00025DD6 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
00427B42 0012E3D4 0012E990 00000001 00010098 50000000 0001:00026B42 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
004280DA 0012E468 0012E5F4 77E1343F 00010090 00000005 0001:000270DA C:\Program Files\ewido anti-spyware 4.0\ewido.exe
77E139E5 0012E488 00010090 00000005 00000000 014402C4 SendMessageW+43
Loaded Modules:
Base Size Module
00400000 609000 4.00.0000.0172 C:\Program Files\ewido anti-spyware 4.0\ewido.exe
77F80000 07D000 5.00.2195.6899 C:\WINNT\system32\ntdll.dll
690A0000 00B000 5.00.2134.0001 C:\WINNT\system32\PSAPI.DLL
7C570000 0B8000 5.00.2195.6897 C:\WINNT\system32\KERNEL32.DLL
10000000 0E3000 4.00.0000.0172 C:\Program Files\ewido anti-spyware 4.0\engine.dll
70A70000 064000 6.00.2800.1552 C:\WINNT\system32\SHLWAPI.dll
78000000 045000 6.01.9844.0000 C:\WINNT\system32\msvcrt.dll
77F40000 03E000 5.00.2195.6898 C:\WINNT\system32\GDI32.dll
77E10000 065000 5.00.2195.6897 C:\WINNT\system32\USER32.DLL
7C2D0000 062000 5.00.2195.6876 C:\WINNT\system32\ADVAPI32.dll
77D30000 071000 5.00.2195.6904 C:\WINNT\system32\RPCRT4.DLL
75030000 014000 5.00.2195.6601 C:\WINNT\system32\WS2_32.dll
75020000 008000 5.00.2134.0001 C:\WINNT\system32\WS2HELP.DLL
77570000 030000 5.00.2161.0001 C:\WINNT\system32\WINMM.dll
782F0000 245000 5.00.3900.6922 C:\WINNT\system32\SHELL32.dll
71710000 084000 5.81.4916.0400 C:\WINNT\system32\COMCTL32.dll
6B2C0000 005000 5.00.2180.0001 C:\WINNT\system32\MSIMG32.dll
76B30000 03E000 5.00.3700.6693 C:\WINNT\system32\comdlg32.dll
77A50000 0EF000 5.00.2195.6906 C:\WINNT\system32\ole32.dll
75050000 008000 5.00.2195.6603 C:\WINNT\system32\WSOCK32.dll
77340000 013000 5.00.2195.6602 C:\WINNT\system32\iphlpapi.dll
77520000 005000 5.00.2134.0001 C:\WINNT\system32\ICMP.DLL
77320000 017000 5.00.2181.0001 C:\WINNT\system32\MPRAPI.DLL
75150000 00F000 5.00.2195.6897 C:\WINNT\system32\SAMLIB.DLL
75170000 04F000 5.00.2195.6949 C:\WINNT\system32\NETAPI32.DLL
7C340000 00F000 5.00.2195.6695 C:\WINNT\system32\Secur32.dll
77BF0000 011000 5.00.2195.6666 C:\WINNT\system32\NTDSAPI.dll
77980000 024000 5.00.2195.6824 C:\WINNT\system32\DNSAPI.DLL
77950000 02A000 5.00.2195.6666 C:\WINNT\system32\WLDAP32.DLL
751C0000 006000 5.00.2134.0001 C:\WINNT\system32\NETRAP.dll
779B0000 09B000 2.40.4522.0000 C:\WINNT\system32\OLEAUT32.DLL
773B0000 02F000 5.00.2195.6601 C:\WINNT\system32\ACTIVEDS.DLL
77380000 023000 5.00.2195.6701 C:\WINNT\system32\ADSLDPC.DLL
77830000 00E000 5.00.2168.0001 C:\WINNT\system32\RTUTILS.DLL
77880000 08E000 5.00.2195.6622 C:\WINNT\system32\SETUPAPI.DLL
7C0F0000 061000 5.00.2195.6794 C:\WINNT\system32\USERENV.DLL
774E0000 033000 5.00.2195.6625 C:\WINNT\system32\RASAPI32.DLL
774C0000 011000 5.00.2195.6738 C:\WINNT\system32\RASMAN.DLL
77530000 022000 5.00.2195.6664 C:\WINNT\system32\TAPI32.DLL
77360000 019000 5.00.2195.6685 C:\WINNT\system32\DHCPCSVC.DLL
77820000 007000 5.00.2195.6623 C:\WINNT\system32\VERSION.dll
759B0000 006000 5.00.2195.6611 C:\WINNT\system32\LZ32.DLL
75E60000 01A000 5.00.2195.6655 C:\WINNT\system32\IMM32.DLL
775A0000 090000 2000.02.3511.0000 C:\WINNT\system32\CLBCATQ.DLL
77840000 03E000 5.00.2195.6705 C:\WINNT\system32\cscui.dll
770C0000 023000 5.00.2195.6713 C:\WINNT\system32\CSCDLL.DLL
72A00000 02D000 5.00.2195.6613 C:\WINNT\system32\DBGHELP.DLL
___________________