What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

New - Need Help with Hijack log

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 9:58:00 PM, on 9/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\WINDOWS\lyowyfqA.exe
C:\WINDOWS\huaodprA.exe
C:\WINDOWS\duxthfmA.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\pmspl.exe
C:\WINDOWS\system32\ntlsapi.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\UmljaGFyZA\command.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Richard\Desktop\wpsetup(2).exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Richard\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: (no name) - {B6A5B638-6025-4C2C-A899-867B416453D2} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [lyowyfqA] C:\WINDOWS\lyowyfqA.exe
O4 - HKLM\..\Run: [ibd8d523] RUNDLL32.EXE w002a52f.dll,n 0018d52200000003002a52f
O4 - HKLM\..\Run: [livphpdA] C:\WINDOWS\livphpdA.exe
O4 - HKLM\..\Run: [huaodprA] C:\WINDOWS\huaodprA.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [duxthfmA] C:\WINDOWS\duxthfmA.exe
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [query] "C:\WINDOWS\system32\query.exe"
O4 - HKCU\..\Run: [test] C:\WINDOWS\system32\test.exe
O4 - HKCU\..\Run: [pmspl] C:\WINDOWS\system32\pmspl.exe
O4 - HKCU\..\Run: [wmgr] C:\WINDOWS\system32\wmgr.exe
O4 - HKCU\..\Run: [vjoy] C:\WINDOWS\system32\vjoy.exe
O4 - HKCU\..\Run: [ntlsapi] C:\WINDOWS\system32\ntlsapi.exe
O4 - HKCU\..\Run: [Ayzf] C:\WINDOWS\??sks\s?chost.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {65407935-456B-47A1-B7D0-3D6BDF6F987F} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Support - {7923DBBD-4639-4B6A-BDFE-497A4F29A512} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {D19F17EF-615E-4FA2-8AC6-5C541FB0FB46} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} (Confidence Online for Web Applications) - https://dbrasweb-ny1.us.db.com/llclient/dbr…java+AXXPEE.dll
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\lapsd11n.dll
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\ilakeng.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UmljaGFyZA\command.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
Post #2
richaggs :D

Welcome to Tom Coyote, you have quite a few nasty things going on, this is not going to be easy to fix.


Hijackthis 1.99.1
Its important that Hijackthis is installed in its own permanent folder for backup purposes.
  • Go to where you currently have HJT installed and delete the whole folder.
  • Use the link above or the links in my signature to download HJT 1.99.1 setup to your desktop
  • Double Click on the Setup icon and by defaut it will unzip to C:\Program Files\Hijackthis
  • HJT should now reside in C:\Program Files\Hijackthis\Hijackthis.exe





  • Go to Start> Run and type in services.msc then press Enter
  • Scroll down to Command Service
  • Double Click that service to open it.
  • Click on Stop Service.
  • Then change the Startup Type to Disabled.
    Do the same for Network Monitor
  • OK your way out of the program.
  • Open HJT > Misc Tools > Delete an NT Service
  • Type in cmdService
  • Then click on OK, it will ask you to reboot, do so.
Do the same for Network Monitor





Please download ComboFix by sUBs from either of these two locations

BleepingComputerComboFix
TechSupportForumComboFix
  • Double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply along with a new HJT log please.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


Let me see the report from Combofix and a new HJT log please.

Ken :D
Post #3
Hello Ken. Thanks very much for your help. It is much appreciated. ComboFix log and new HJT log below:

Regards,
Richard



Richard - 06-09-23 20:23:08.20 Service Pack 2
ComboFix 06.09.23.2 - Running from: "C:\Program Files\Mozilla Firefox"

((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))

REGISTRY ENTRIES REMOVED:

[HKEY_CLASSES_ROOT\CLSID\{2B0FBE8C-DC71-48E3-AFD8-FC3B4A1C3EA4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2B0FBE8C-DC71-48E3-AFD8-FC3B4A1C3EA4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2B0FBE8C-DC71-48E3-AFD8-FC3B4A1C3EA4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2B0FBE8C-DC71-48E3-AFD8-FC3B4A1C3EA4}\InprocServer32]
@="C:\\WINDOWS\\system32\\lztga11n.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{D3679ED7-A529-4D60-931A-AE77E654D6F6}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D3679ED7-A529-4D60-931A-AE77E654D6F6}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D3679ED7-A529-4D60-931A-AE77E654D6F6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D3679ED7-A529-4D60-931A-AE77E654D6F6}\InprocServer32]
@="C:\\WINDOWS\\system32\\nu4_disp.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{27A0B8CA-2EF0-4342-98B0-4FF577A35BE9}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{27A0B8CA-2EF0-4342-98B0-4FF577A35BE9}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{27A0B8CA-2EF0-4342-98B0-4FF577A35BE9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{27A0B8CA-2EF0-4342-98B0-4FF577A35BE9}\InprocServer32]
@="C:\\WINDOWS\\system32\\xcsp2res.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{DB0C0259-D690-4A47-ADA5-C10E7C1C18EE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB0C0259-D690-4A47-ADA5-C10E7C1C18EE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB0C0259-D690-4A47-ADA5-C10E7C1C18EE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB0C0259-D690-4A47-ADA5-C10E7C1C18EE}\InprocServer32]
@="C:\\WINDOWS\\system32\\dmactfrm.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{E2DB8121-58D0-4805-AFD7-843FFA3E3C9F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E2DB8121-58D0-4805-AFD7-843FFA3E3C9F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E2DB8121-58D0-4805-AFD7-843FFA3E3C9F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E2DB8121-58D0-4805-AFD7-843FFA3E3C9F}\InprocServer32]
@="C:\\WINDOWS\\system32\\wdd_ci.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{B6A37BE6-3FF9-4FA1-9A04-8A38EF1D4119}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B6A37BE6-3FF9-4FA1-9A04-8A38EF1D4119}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B6A37BE6-3FF9-4FA1-9A04-8A38EF1D4119}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B6A37BE6-3FF9-4FA1-9A04-8A38EF1D4119}\InprocServer32]
@="C:\\WINDOWS\\system32\\skhcinst.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{3FA326D6-C033-4555-8AF5-B8C52CEA50EF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3FA326D6-C033-4555-8AF5-B8C52CEA50EF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3FA326D6-C033-4555-8AF5-B8C52CEA50EF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3FA326D6-C033-4555-8AF5-B8C52CEA50EF}\InprocServer32]
@="C:\\WINDOWS\\system32\\wjadefui.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{2E153652-ADBA-4D32-BA4B-3E9F568438D7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2E153652-ADBA-4D32-BA4B-3E9F568438D7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2E153652-ADBA-4D32-BA4B-3E9F568438D7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2E153652-ADBA-4D32-BA4B-3E9F568438D7}\InprocServer32]
@="C:\\WINDOWS\\system32\\dzdmoprp.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{FF5D0A20-9160-41BB-B532-8BB8138F6DC5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FF5D0A20-9160-41BB-B532-8BB8138F6DC5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FF5D0A20-9160-41BB-B532-8BB8138F6DC5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FF5D0A20-9160-41BB-B532-8BB8138F6DC5}\InprocServer32]
@="C:\\WINDOWS\\system32\\MFCTFP.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{80616042-DF66-4267-A3D7-028D1EFD67BA}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\CLSID\{80616042-DF66-4267-A3D7-028D1EFD67BA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{80616042-DF66-4267-A3D7-028D1EFD67BA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{80616042-DF66-4267-A3D7-028D1EFD67BA}\InprocServer32]
@="C:\\WINDOWS\\system32\\uirdpa.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{74CC5770-9D89-482C-9244-581C09B81828}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{74CC5770-9D89-482C-9244-581C09B81828}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{74CC5770-9D89-482C-9244-581C09B81828}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{74CC5770-9D89-482C-9244-581C09B81828}\InprocServer32]
@="C:\\WINDOWS\\system32\\qrap.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{CBA264A6-C188-41D8-A4F9-6D38CA69B1EA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CBA264A6-C188-41D8-A4F9-6D38CA69B1EA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CBA264A6-C188-41D8-A4F9-6D38CA69B1EA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CBA264A6-C188-41D8-A4F9-6D38CA69B1EA}\InprocServer32]
@="C:\\WINDOWS\\system32\\oguninst.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{EC185A24-11DA-4907-AE3F-3E84CEE9168B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC185A24-11DA-4907-AE3F-3E84CEE9168B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC185A24-11DA-4907-AE3F-3E84CEE9168B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC185A24-11DA-4907-AE3F-3E84CEE9168B}\InprocServer32]
@="C:\\WINDOWS\\system32\\apledit.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{9E2BC020-220B-438D-A618-CF7EB1826668}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E2BC020-220B-438D-A618-CF7EB1826668}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E2BC020-220B-438D-A618-CF7EB1826668}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E2BC020-220B-438D-A618-CF7EB1826668}\InprocServer32]
@="C:\\WINDOWS\\system32\\iUshlpr.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{515DAFB3-F883-4D67-A4A4-3F7EB48921E2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{515DAFB3-F883-4D67-A4A4-3F7EB48921E2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{515DAFB3-F883-4D67-A4A4-3F7EB48921E2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{515DAFB3-F883-4D67-A4A4-3F7EB48921E2}\InprocServer32]
@="C:\\WINDOWS\\system32\\BmWebIns.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{C13F4F0C-A90E-4897-A0FE-7487595740BE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C13F4F0C-A90E-4897-A0FE-7487595740BE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C13F4F0C-A90E-4897-A0FE-7487595740BE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C13F4F0C-A90E-4897-A0FE-7487595740BE}\InprocServer32]
@="C:\\WINDOWS\\system32\\Aqdiodev.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{2385B1AB-8DD6-43FC-9AC9-2BF4568C4672}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2385B1AB-8DD6-43FC-9AC9-2BF4568C4672}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2385B1AB-8DD6-43FC-9AC9-2BF4568C4672}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2385B1AB-8DD6-43FC-9AC9-2BF4568C4672}\InprocServer32]
@="C:\\WINDOWS\\system32\\igagehlp.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{F5A24D9F-DDF4-4ACA-8E67-C72789AE5437}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F5A24D9F-DDF4-4ACA-8E67-C72789AE5437}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F5A24D9F-DDF4-4ACA-8E67-C72789AE5437}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F5A24D9F-DDF4-4ACA-8E67-C72789AE5437}\InprocServer32]
@="C:\\WINDOWS\\system32\\wlvdmoe2.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{AD888020-8748-437C-A1EC-C78D319D5848}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD888020-8748-437C-A1EC-C78D319D5848}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD888020-8748-437C-A1EC-C78D319D5848}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AD888020-8748-437C-A1EC-C78D319D5848}\InprocServer32]
@="C:\\WINDOWS\\system32\\sessetup.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{17B17B12-F163-4C42-BC52-21A64FDE60F0}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{17B17B12-F163-4C42-BC52-21A64FDE60F0}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{17B17B12-F163-4C42-BC52-21A64FDE60F0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{17B17B12-F163-4C42-BC52-21A64FDE60F0}\InprocServer32]
@="C:\\WINDOWS\\system32\\ilakeng.dll"
"ThreadingModel"="Apartment"

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


Granting sedebugprivilege to Administrators … successful


((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\dxclib303562752.dll
C:\Documents and Settings\Richard\Application Data\Dxcknwrd.dll
C:\WINDOWS\system32\bkd.exe
C:\Program Files\DeluxeCommunications\Dxc.exe
C:\Program Files\DeluxeCommunications\DxcBho.dll
C:\Program Files\DeluxeCommunications\DxcCore.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\teller2.chk
C:\dfndrff_e10.exe
C:\dfndrff_e11.exe
C:\dfndrff_e12.exe
C:\drsmartload.exe
C:\drsmartload45a45a45f.exe
C:\deskbar.exe
C:\kybrdff_e11.exe
C:\kybrdff_e12.exe
C:\MTE3NDI6ODoxNg.exe
C:\nwnmff_e11.exe
C:\nwnmff_e12.exe
C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\8JK3MNOP\dfndrff_e_uit[1].exe
C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\8JK3MNOP\drsmartload45a[1].exe
C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\QRSBUVWF\drsmartload815a[1].exe
C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\GH01KL4N\kybrdff_e[1].exe
C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\O7Q9ATCV\MTE3NDI6ODoxNg[1].exe
C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\GH01KL4N\nwnmff_e[1].exe
C:\WINDOWS\system32\bszip.dll
C:\mte3ndi6odoxng.exe
C:\Program Files\Common Files\misc002
C:\Program Files\Common Files\{140BD78E-0745-1033-0928-051114200001}
C:\Program Files\Deskbar

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Richard\Application Data\CROSOF~1.NET
C:\QooBox\Purity\Documents and Settings\Richard\Application Data\CROSOF~1.NET\CROSOF~1.NET
C:\QooBox\Purity\WINDOWS\SKS~1


((((((((((((((((((((((((((((((( Files Created from 2006-08-23 to 2006-09-23 ))))))))))))))))))))))))))))))))))


2006-09-23 13:30 578,560 –a—— C:\Installer4.exe
2006-09-23 13:29 667,889 –a—— C:\deskbar_e12.exe
2006-09-22 20:29 676,081 –a—— C:\deskbar_e11.exe
2006-09-20 23:32 90,112 –a—— C:\WINDOWS\system32\AVASTSS.scr
2006-09-20 23:32 597,504 –a—— C:\WINDOWS\system32\aswBoot.exe
2006-09-17 00:48 215,308 –a—— C:\WINDOWS\srvrzejleb.exe
2006-09-17 00:48 163,840 –a—— C:\WINDOWS\ms04203983363.exe
2006-09-17 00:47 437,824 -r-hs—- C:\WINDOWS\duxthfm.exe
2006-09-17 00:47 436,864 -r-hs—- C:\WINDOWS\duxthfmA.exe
2006-08-31 12:33 159,744 –a—— C:\WINDOWS\sys01363203983.exe
2006-08-31 12:14 928 –a—— C:\WINDOWS\system32\winpfg32.sys
2006-08-31 09:29 144 –a—— C:\WINDOWS\file.bat
2006-08-31 09:27 215,308 –a—— C:\WINDOWS\srvkyikmii.exe
2006-08-31 09:27 159,744 –a—— C:\WINDOWS\win3209336320398.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-23 20:24 ——– d——– C:\Program Files\Common Files
2006-09-23 20:22 ——– d——– C:\Program Files\Mozilla Firefox
2006-09-23 20:20 ——– d——– C:\Program Files\Hijackthis
2006-09-23 13:33 ——– d——– C:\Program Files\Spyware Doctor
2006-09-21 23:08 ——– d—s—- C:\Documents and Settings\Richard\Application Data\Microsoft
2006-09-21 22:58 ——– d——– C:\Program Files\SpywareBlaster
2006-09-20 23:32 ——– d——– C:\Program Files\Alwil Software
2006-09-17 21:53 ——– d——– C:\Program Files\iTunes
2006-09-17 21:53 ——– d——– C:\Program Files\iPod
2006-09-17 21:48 ——– d——– C:\Program Files\QuickTime
2006-09-17 21:46 ——– d——– C:\Program Files\Apple Software Update
2006-09-17 19:45 ——– d——– C:\Program Files\Steganos AntiSpyware 2006
2006-09-17 14:53 ——– d——– C:\Program Files\Sunbelt Software
2006-09-14 20:14 ——– d——– C:\Program Files\Google
2006-09-09 22:57 ——– d——– C:\Documents and Settings\Richard\Application Data\AdobeUM
2006-09-09 22:46 56 -r-hs—- C:\WINDOWS\system32\8C446BA7C5.sys
2006-09-09 22:46 3766 –ahs—- C:\WINDOWS\system32\KGyGaAvL.sys
2006-08-31 09:29 51072 –a—— C:\WINDOWS\system32\drivers\ikhlayer.sys
2006-08-25 11:18 ——– d——– C:\Program Files\Zone Labs
2006-08-23 10:42 28672 –a—— C:\WINDOWS\system32\drivers\CO_Mon.sys
2006-08-22 09:24 ——– d——– C:\Program Files\America Online 9.0
2006-08-21 08:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll
2006-08-21 05:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe
2006-08-21 05:14 128896 ——— C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-20 13:59 ——– d——– C:\Program Files\Common Files\foiz
2006-08-19 20:55 518 –a—— C:\WINDOWS\sncnv.dll
2006-08-18 22:42 ——– d——– C:\Program Files\Windows NT
2006-08-18 11:16 186223 –a—— C:\WINDOWS\srvevjrfft.exe
2006-08-11 21:53 ——– d——– C:\Program Files\Internet Explorer
2006-07-27 09:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-07-21 04:24 72704 –a—— C:\WINDOWS\system32\hlink.dll
2006-07-20 20:45 1063 –a—— C:\WINDOWS\system32\ibd8d523.sys
2006-07-15 21:51 4 –a—— C:\WINDOWS\uccspecb.sys
2006-07-14 14:51 108144 –a—— C:\WINDOWS\system32\GEARAspi.dll
2006-07-02 19:57 172 –a—— C:\~~uninst.bat
2006-06-30 20:52 9728 –a—— C:\WINDOWS\system32\test.exe
2006-06-29 21:04 8464 –a—— C:\WINDOWS\system32\sporder.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"query"="\"C:\\WINDOWS\\system32\\query.exe\""
"test"="C:\\WINDOWS\\system32\\test.exe"
"pmspl"="C:\\WINDOWS\\system32\\pmspl.exe"
"wmgr"="C:\\WINDOWS\\system32\\wmgr.exe"
"vjoy"="C:\\WINDOWS\\system32\\vjoy.exe"
"ntlsapi"="C:\\WINDOWS\\system32\\ntlsapi.exe"
"Ayzf"="C:\\WINDOWS\\??sks\\s?chost.exe"
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"PSLister"="\"C:\\Program Files\\PSLister\\PSLister.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe"
@=""
"IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless"
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~3\\mimboot.exe"
"Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup"
"BJCFD"="C:\\Program Files\\BroadJump\\Client Foundation\\CFD.exe"
"Corel Photo Downloader"="C:\\Program Files\\Corel\\Corel Photo Album 6\\MediaDetect.exe"
"type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"ibd8d523"="RUNDLL32.EXE w002a52f.dll,n 0018d52200000003002a52f"
"livphpdA"="C:\\WINDOWS\\livphpdA.exe"
"huaodprA"="C:\\WINDOWS\\huaodprA.exe"
"duxthfmA"="C:\\WINDOWS\\duxthfmA.exe"
"SunServer"="C:\\Program Files\\Sunbelt Software\\CounterSpy\\Consumer\\sunserver.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"lyowyfqA"="C:\\WINDOWS\\lyowyfqA.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,fe,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{076394AD-7FDD-44EF-A075-32C68DBAB99B}"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Completion time: Sat 09/23/2006 20:28:41.23
ComboFix.txt








Logfile of HijackThis v1.99.1
Scan saved at 8:35:28 PM, on 9/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\WINDOWS\huaodprA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\duxthfmA.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\WINDOWS\system32\vjoy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Digital Line Detect\DLG.exe
c:\nwnmff_e12.exe
c:\dfndrff_e12.exe
c:\kybrdff_e12.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ibd8d523] RUNDLL32.EXE w002a52f.dll,n 0018d52200000003002a52f
O4 - HKLM\..\Run: [livphpdA] C:\WINDOWS\livphpdA.exe
O4 - HKLM\..\Run: [huaodprA] C:\WINDOWS\huaodprA.exe
O4 - HKLM\..\Run: [duxthfmA] C:\WINDOWS\duxthfmA.exe
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lyowyfqA] C:\WINDOWS\lyowyfqA.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [query] "C:\WINDOWS\system32\query.exe"
O4 - HKCU\..\Run: [test] C:\WINDOWS\system32\test.exe
O4 - HKCU\..\Run: [pmspl] C:\WINDOWS\system32\pmspl.exe
O4 - HKCU\..\Run: [wmgr] C:\WINDOWS\system32\wmgr.exe
O4 - HKCU\..\Run: [vjoy] C:\WINDOWS\system32\vjoy.exe
O4 - HKCU\..\Run: [ntlsapi] C:\WINDOWS\system32\ntlsapi.exe
O4 - HKCU\..\Run: [Ayzf] C:\WINDOWS\??sks\s?chost.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {65407935-456B-47A1-B7D0-3D6BDF6F987F} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Support - {7923DBBD-4639-4B6A-BDFE-497A4F29A512} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {D19F17EF-615E-4FA2-8AC6-5C541FB0FB46} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} (Confidence Online for Web Applications) - https://dbrasweb-ny1.us.db.com/llclient/dbr…java+AXXPEE.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
Post #4
Richard, :D

Florida 12 Kentucky 7 at the half. :D

Open HJT Scan Only, close your browser and all open windows, check these entries and click on Fix Checked

R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)

O3 - Toolbar: (no name) - {B6A5B638-6025-4C2C-A899-867B416453D2} - (no file)

O4 - HKLM\..\Run: [lyowyfqA] C:\WINDOWS\lyowyfqA.exe
O4 - HKLM\..\Run: [ibd8d523] RUNDLL32.EXE w002a52f.dll,n 0018d52200000003002a52f
O4 - HKLM\..\Run: [livphpdA] C:\WINDOWS\livphpdA.exe
O4 - HKLM\..\Run: [huaodprA] C:\WINDOWS\huaodprA.exe
O4 - HKLM\..\Run: [duxthfmA] C:\WINDOWS\duxthfmA.exe
O4 - HKCU\..\Run: [test] C:\WINDOWS\system32\test.exe
O4 - HKCU\..\Run: [pmspl] C:\WINDOWS\system32\pmspl.exe
O4 - HKCU\..\Run: [wmgr] C:\WINDOWS\system32\wmgr.exe
O4 - HKCU\..\Run: [vjoy] C:\WINDOWS\system32\vjoy.exe
O4 - HKCU\..\Run: [ntlsapi] C:\WINDOWS\system32\ntlsapi.exe
O4 - HKCU\..\Run: [Ayzf] C:\WINDOWS\??sks\s?chost.exe
O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"



Download Pocket Killbox to your desktop, unzip it to a folder that you can find



Highlight all the files with the complete path inside the quote box and press Ctrl C on your keyboard.

C:\Installer4.exe
C:\deskbar_e12.exe
C:\deskbar_e11.exe
c:\dfndrff_e12.exe
c:\kybrdff_e12.exe
c:\nwnmff_e12.exe
C:\WINDOWS\file.bat
C:\WINDOWS\duxthfm.exe
C:\WINDOWS\duxthfmA.exe
C:\WINDOWS\huaodprA.exe
C:\WINDOWS\lyowyfqA.exe
C:\WINDOWS\ms04203983363.exe
C:\WINDOWS\srvkyikmii.exe
C:\WINDOWS\srvrzejleb.exe
C:\WINDOWS\UmljaGFyZA
C:\WINDOWS\system32\vjoy.exe
C:\WINDOWS\win3209336320398.exe
C:\WINDOWS\sys01363203983.exe
C:\WINDOWS\system32\ntlsapi.exe
C:\WINDOWS\system32\pmspl.exe
C:\WINDOWS\system32\winpfg32.sys
C:\Program Files\Network Monitor



  • Open Pocket Killbox
  • Go to File > Paste from clipboard
  • Set it to Delete on Reboot
  • Tick the box that says End Explorer shell while killing file
  • If its not greyed out..Click the radio button that say Unregister .dll before deleting.
  • Make sure ALL Files is selected
  • Click on the Red circle with the white X
  • It will ask you to confirm the deletion…Say yes
  • It will ask you to reboot, say yes




Download and install the 30 day trial of Ewido Anti Spyware to your desktop.
  • Once you have downloaded Ewido Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run Ewido and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close Ewido Anti-Spyware <– Do not run the scan yet.
Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch Ewido-Anti-Spyware by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • Ewido will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close Ewido


Run this system cleaner

Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.

Post the Ewido Report and a new HJT log.

Ken :D
Post #5
Here you go Ken…. ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 10:47:38 PM 9/23/2006 + Scan result: HKU\S-1-5-21-1840244912-2273793654-3444988715-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\O7Q9ATCV\drsmartload815a[1].exe -> Downloader.Adload.ds : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\drsmartload815a.exe -> Downloader.Adload.ds : Cleaned with backup (quarantined). C:\drsmartload.exe -> Downloader.Adload.fp : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\QRSBUVWF\drsmartload45a[1].exe -> Downloader.Adload.fq : Cleaned with backup (quarantined). C:\drsmartload45a45a45f.exe -> Downloader.Adload.fq : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\CF05855B-ED86-458E-BEFB-E96019\B292A527-C213-4045-99A6-376C39 -> Downloader.Agent.aqx : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\O7Q9ATCV\MTE3NDI6ODoxNg[1].exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\35C144DD-7FA5-43A2-972B-E21767\DDC3EAC0-0AEA-4C38-8D1B-CB7642 -> Downloader.VB.ach : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\D623AC61-7BA2-4AAE-9FAC-45169F\FC80E03B-0633-4083-B920-9188FB -> Downloader.VB.ach : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\EA027071-84E2-4C09-8418-34AAAB\49885D91-D209-4FF5-ABF6-98EA76 -> Downloader.VB.ach : Cleaned with backup (quarantined). C:\!KillBox\huaodprA.exe -> Downloader.VB.alu : Cleaned with backup (quarantined). C:\!KillBox\duxthfmA.exe -> Downloader.VB.ang : Cleaned with backup (quarantined). C:\Program Files\DIGStream\digstream.exe -> Not-A-Virus.Downloader.Win32.DigStream : Cleaned with backup (quarantined). :mozilla.287:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Cookies\richard@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.48:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined). :mozilla.594:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). :mozilla.595:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). :mozilla.596:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). :mozilla.846:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). :mozilla.847:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). :mozilla.848:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined). :mozilla.63:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Admarketplace : Cleaned with backup (quarantined). :mozilla.64:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Admarketplace : Cleaned with backup (quarantined). :mozilla.65:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Admarketplace : Cleaned with backup (quarantined). :mozilla.66:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Admarketplace : Cleaned with backup (quarantined). :mozilla.67:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Admarketplace : Cleaned with backup (quarantined). :mozilla.68:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Admarketplace : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Cookies\richard@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned with backup (quarantined). :mozilla.57:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). :mozilla.69:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). :mozilla.550:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned with backup (quarantined). :mozilla.166:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.167:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.168:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.169:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.297:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.298:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.299:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.300:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.353:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.354:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.355:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.37:C:\Documents and Settings\Pattiann\Application Data\Mozilla\Firefox\Profiles\f3l7nhia.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). :mozilla.16:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.35:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.125:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.129:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.143:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.147:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.148:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.221:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.246:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.280:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.284:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.285:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.292:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.293:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.37:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.386:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.387:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.396:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.397:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.398:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.399:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.405:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.425:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.426:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.427:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.428:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.429:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.430:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.431:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.432:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.433:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.434:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.435:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.436:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.437:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.438:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.439:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.440:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.441:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.442:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.443:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.444:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.445:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.446:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.447:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.448:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.449:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.450:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.451:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.452:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.453:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.454:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.455:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.456:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.457:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.457:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.458:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.458:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.459:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.459:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.460:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.460:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.461:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.461:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.462:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.462:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.463:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.463:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.464:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.464:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.465:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.466:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.467:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.468:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.469:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.470:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.471:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.472:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.473:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.473:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.474:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.474:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.475:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.475:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.476:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.476:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.477:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.477:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.478:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.479:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.480:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.481:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.482:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.483:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.484:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.485:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.487:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.488:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.489:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.506:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.523:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.524:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.526:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.527:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.528:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.529:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.530:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.573:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.684:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.707:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.70:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.710:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.71:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.721:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.722:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.723:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.724:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.725:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.726:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.727:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.728:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.728:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.729:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.72:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.730:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.731:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.731:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.732:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.732:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.733:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.733:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.734:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.735:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.736:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.737:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.738:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.739:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.73:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.740:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.741:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.742:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.743:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.744:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.745:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.746:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.747:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.748:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.749:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.750:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.751:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.752:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.752:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.753:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.753:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.754:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.754:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.755:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.756:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.757:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.758:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.759:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.760:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.761:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.762:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.763:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.764:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.765:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.766:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.767:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.768:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.769:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.770:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined). :mozilla.335:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). :mozilla.618:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). :mozilla.422:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Findwhat : Cleaned with backup (quarantined). :mozilla.508:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Findwhat : Cleaned with backup (quarantined). :mozilla.584:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined). :mozilla.22:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). :mozilla.24:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). :mozilla.64:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). :mozilla.65:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). :mozilla.34:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.60:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.61:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.62:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.63:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.578:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.579:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.580:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.644:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.645:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.646:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.906:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined). :mozilla.44:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.45:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.46:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.52:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.53:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.227:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.228:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.517:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.518:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.519:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.520:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.80:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.81:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.83:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.84:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.86:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined). :mozilla.247:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.248:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.249:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.319:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.320:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.321:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.322:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.370:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.372:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-1.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.47:C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies-2.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\905C4103-015A-4CF8-B6ED-9C6FCE\92F6BD23-5F2D-4424-9FA7-051927 -> Trojan.LdPinch.arr : Cleaned with backup (quarantined). ::Report end Logfile of HijackThis v1.99.1 Scan saved at 10:56:52 PM, on 9/23/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Microsoft IntelliType Pro\type32.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Hijackthis\HijackTh
Post #7
Oops! Sorry! Here you go:

Logfile of HijackThis v1.99.1
Scan saved at 11:26:54 PM, on 9/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [query] "C:\WINDOWS\system32\query.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {65407935-456B-47A1-B7D0-3D6BDF6F987F} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Support - {7923DBBD-4639-4B6A-BDFE-497A4F29A512} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {D19F17EF-615E-4FA2-8AC6-5C541FB0FB46} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} (Confidence Online for Web Applications) - https://dbrasweb-ny1.us.db.com/llclient/dbr…java+AXXPEE.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
Post #8
Richard,

Your log is looking sooooo much better :thumbup: but we are not 100% out of the woods yet.

You need to disable Spyware Doctor, not one of my favorite programs so I am not familiar with it, but you maybe able to right click on the icon in the system tray and shut down the program.

Then remove this entry with HJT.

R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)


  • Your Java is out of date and leaving your system vulnerable.
  • Go to your Add-Remove Programs in the Control Panel and uninstall any previous (jre) installations.
  • Reboot your system.
  • Then go to the Sun Java website and download and install the update.
  • Java Runtime Environment (JRE) 5.0 Update 8 <–This is what you need to download and install.
  • Then after install you can verify your installation here Sun Java Verify


You log looks good, but lets run this free online virus scanner from Panda, it wont remove anything but will give us a report. Paste the report into this thread along with a new HJT log.
Panda ActiveScan <—Accept default settings


Take your time, be back in the AM, been a looooooog day.

Ken :D
Post #9
Thanks Ken, did the Java update. Here are the logs. Have a great night!

Incident Status Location

Adware:adware/dollarrevenue Not disinfected c:\windows\keyboard1.dat
Adware:adware/searchexe Not disinfected Windows Registry
Adware:Adware/ActiveSearch Not disinfected C:\!KillBox\deskbar_e11.exe[deskbar.exe][deskbar.dll]
Adware:Adware/ActiveSearch Not disinfected C:\!KillBox\deskbar_e12.exe[deskbar.exe][deskbar.dll]
Adware:Adware/Popper Not disinfected C:\!KillBox\duxthfm.exe
Adware:Adware/DigInk Not disinfected C:\!KillBox\ms04203983363.exe
Adware:Adware/DigInk Not disinfected C:\!KillBox\srvkyikmii.exe
Adware:Adware/DigInk Not disinfected C:\!KillBox\srvrzejleb.exe
Adware:Adware/DigInk Not disinfected C:\!KillBox\sys01363203983.exe
Adware:Adware/DigInk Not disinfected C:\!KillBox\win3209336320398.exe
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Pattiann\Application Data\Mozilla\Firefox\Profiles\f3l7nhia.default\cookies.txt[.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Pattiann\Application Data\Mozilla\Firefox\Profiles\f3l7nhia.default\cookies.txt[stats.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Pattiann\Application Data\Mozilla\Firefox\Profiles\f3l7nhia.default\cookies.txt[.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Pattiann\Application Data\Mozilla\Firefox\Profiles\f3l7nhia.default\cookies.txt[stats.drivecleaner.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt[.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt[www.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt[stats.drivecleaner.com/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt[searchportal.information.com/]
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\7ht7xai3.default\cookies.txt[.entrepreneur.com/]
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Richard\Desktop\Fastmp3_Setup.exe
Adware:Adware/Sqwire Not disinfected C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\25636B71-D1D1-4D6A-8694-CE12D9\911BD827-2DAE-4701-96E0-8F21AD[stub_109_4_0_4_0.exe]
Adware:Adware/PCodec Not disinfected C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\25636B71-D1D1-4D6A-8694-CE12D9\911BD827-2DAE-4701-96E0-8F21AD[²ÜÇ\nsRandom.dll]
Adware:Adware/ActiveSearch Not disinfected C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\4F8B23B3-11A1-4F17-9605-378411\262F7271-5C4B-446A-AFF9-9385C7[deskbar.dll]
Adware:Adware/ActiveSearch Not disinfected C:\Documents and Settings\Richard\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\4F8B23B3-11A1-4F17-9605-378411\AD4AB677-8C20-4DBD-9B8E-0DC21B[deskbar.exe][deskbar.dll]
Spyware:Spyware/7r7t Not disinfected C:\WINDOWS\srvevjrfft.exe
Adware:Adware/DollarRevenue Not disinfected C:\WINDOWS\system32\test.exe




Logfile of HijackThis v1.99.1
Scan saved at 12:37:25 AM, on 9/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [query] "C:\WINDOWS\system32\query.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {65407935-456B-47A1-B7D0-3D6BDF6F987F} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Support - {7923DBBD-4639-4B6A-BDFE-497A4F29A512} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {D19F17EF-615E-4FA2-8AC6-5C541FB0FB46} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} (Confidence Online for Web Applications) - https://dbrasweb-ny1.us.db.com/llclient/dbr…java+AXXPEE.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
Post #10
Richard :D

Fastmp3_Setup. <– You have this icon on your desktop, is it something you use or did it just show up ?


Remove this entry with HJT
O4 - HKCU\..\Run: [query] "C:\WINDOWS\system32\query.exe"


Run these through Killbox, make sure All Files is selected.

c:\windows\keyboard1.dat
C:\WINDOWS\srvevjrfft.exe
C:\WINDOWS\system32\test.exe
C:\Documents and Settings\Richard\Desktop\Fastmp3_Setup.exe <–Include this one if you don't know what it is.


The rest of your log looks fine :thumbup: How are things running now???


Ken :D
Post #12
Rich

Thats great :thumbup: :thumbup:


How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

TonyKlein CastleCops
Grinler BleepingComputer
Geeks To Go


I am glad I was able to help you, thanks for using Tom Coyote

Ken…..who can now go finish his beer :rofl:
Post #13
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI