User History:

Searched MP3's in Yahoo Website, Click a link from search result ( hxxp://www.fastmp3search.com.ar) and clicked start downloading… then viruses appears…



AVG History:

Trojan horse Downloader.Generic2.QGA (Moved to Vault / Deleted)



Spybot History:

ZLobDownlaoder, VCodec.5StarVideos, SystemDoctor2006, Smitfraud-C.Toolbar888, Smitfraud-C, MediaMotor, FastClick, DoubleClick, AstaKiller, Alexa Related, Advertising.com (Removed)



Ad-Aware History:

ALEXA

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[0]=Regkey : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

obj[1]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "MenuStatusBar"

obj[2]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "Script"

obj[3]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "clsid"

obj[4]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "Icon"

obj[5]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "HotIcon"

obj[6]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "ButtonText"

obj[7]=RegValue : .DEFAULT\software\microsoft\internet explorer\extensions\cmdmapping "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"

obj[8]=RegValue : S-1-5-18\software\microsoft\internet explorer\extensions\cmdmapping "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"

obj[9]=RegValue : S-1-5-21-1202660629-1708537768-1957994488-1003\software\microsoft\internet explorer\extensions\cmdmapping "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"

ADWARE.FREEPROD TOOLBAR

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[11]=RegValue : SOFTWARE\Microsoft\Internet Explorer\Toolbar "{CBCC61FA-0221-4ccc-B409-CEE865CACA3A}"

obj[21]=RegValue : software\microsoft\windows\currentversion\internet settings "GlobalUserOffline"

obj[22]=Folder : D:\Program Files\ToolBar888

obj[23]=File : d:\program files\toolbar888\mytoolbar.dll

TRACKING COOKIE

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[13]=IECache Entry : Cookie:pc [removed]/

obj[14]=IECache Entry : Cookie:pc [removed]/

obj[15]=IECache Entry : Cookie:pc [removed]/

obj[16]=IECache Entry : Cookie:pc [removed]/

obj[17]=IECache Entry : Cookie:pc [removed]/

ADWARE.ADMEDIA

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[18]=Regkey : software\microsoft\windows\currentversion\internet settings\zonemap\domains\media-motor.net

obj[19]=Regkey : software\microsoft\windows\currentversion\internet settings\zonemap\domains\mmohsix.com

obj[20]=Regkey : software\mm

obj[24]=File : D:\WINDOWS\amm06.ocx

obj[26]=File : D:\Documents and Settings\PC Administrator\Local Settings\Temporary Internet Files\Content.IE5\KL6VWPMF\amm06[1].ocx

SOFTOMATE TOOLBAR

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[25]=File : D:\Documents and Settings\PC Administrator\Local Settings\Temp\nsn2D.tmp\nsProcess.dll

TRACKING COOKIE

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[0]=IECache Entry : Cookie:pc [removed]/

obj[1]=IECache Entry : Cookie:pc [removed]/

TRACKING COOKIE

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[0]=IECache Entry : Cookie:pc [removed]/

obj[1]=IECache Entry : Cookie:pc [removed]/



User History:



HijackThis Log:

Logfile of HijackThis v1.99.1
Scan saved at 1:24:15 AM, on 10/1/2006
Platform: Windows XP SP2, v.2082 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2082)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\sistray.EXE
D:\WINDOWS\system32\khooker.exe
D:\WINDOWS\Mixer.exe
D:\WINDOWS\sm56hlpr.exe
D:\Program Files\FarStone\VirtualDrive\VDTask.exe
D:\WINDOWS\vcdplayx.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Common Files\{404817F9-0364-1033-0208-02040320003f}\Update.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\system32\kbddv.exe
D:\WINDOWS\system32\winscard.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\_Files\Sta_Cruz Documents\KHR Systems\Other Systems\Scheduler\Reminder.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\FlashGet\flashget.exe
C:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRA~1\FLASHGET\jccatch.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SiS Tray] D:\WINDOWS\system32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] D:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [VirtualDrive] "D:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [vcdplayx] "D:\WINDOWS\vcdplayx.exe"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kbddv] D:\WINDOWS\system32\kbddv.exe
O4 - HKCU\..\Run: [winscard] D:\WINDOWS\system32\winscard.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Reminder.lnk = D:\_Files\Sta_Cruz Documents\KHR Systems\Other Systems\Scheduler\Reminder.exe
O4 - Global Startup: IDW Logging Tool.lnk = D:\WINDOWS\system32\idwlog.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - D:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{15703C01-8391-43EC-AA50-96BC3A7D40F3}: NameServer = 203.177.255.10 203.127.225.11
O17 - HKLM\System\CS1\Services\Tcpip\..\{15703C01-8391-43EC-AA50-96BC3A7D40F3}: NameServer = 203.177.255.10 203.127.225.11
O17 - HKLM\System\CS2\Services\Tcpip\..\{15703C01-8391-43EC-AA50-96BC3A7D40F3}: NameServer = 203.177.255.10 203.127.225.11
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: dswave.exe - Unknown owner - D:\WINDOWS\system32\dswave.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe



Please help me with this problem(s)…. Thanks…