jimrod
OK, will do. Will probably be tomorrow.
Spyware / Malware / Virus Removal
Search Problem
10 min read
jimrod
Had visitors this past week so not much time. I ran fixware and hjt 10/21. Logs will follow. IE is now working OK. Also I worked with my son and he got me on an ftp site and I downloaded and installed Firefox so I now have an alternate browser.
Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please
Reg Entries that were deleted
…
Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…
PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»» Searching by size/names…
»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\DMDTH.EXE 60,975 2002-08-29
Other suspects.
Directory of C:\WINDOWS\system32
»»»»» Misc files.
»»»»» Checking for older varients covered by the Rem3 tool.
Logfile of HijackThis v1.99.1
Scan saved at 12:04:27 PM, on 10/21/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
D:\VMware Workstation\vmware-authd.exe
C:\WINDOWS\System32\vmnat.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\YAHOO!\YOP\yop.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Apoint\Apntex.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\YAHOO!\YOP\yop.exe /autostart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s.work4sure.com/c/ge/w4sgeen9.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{47313E96-B4D3-429C-AB3B-CDABDF7A5B17}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{6CAE7395-5097-4B21-838B-80C7FDF0E6DB}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BBC649B-0A49-4BB4-9A48-90FF07F5F8C0}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4FDF768-3383-4A50-8B1A-7F943CB460B5}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{EED20013-830C-47FE-9BA1-663B78A25722}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{FE08B913-1CF8-4256-A643-56B1711871EC}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.118 85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.118 85.255.112.199
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - D:\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - Unknown owner - C:\WINDOWS\System32\vmnat.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -service (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please
Reg Entries that were deleted
…
Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…
PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»» Searching by size/names…
»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\DMDTH.EXE 60,975 2002-08-29
Other suspects.
Directory of C:\WINDOWS\system32
»»»»» Misc files.
»»»»» Checking for older varients covered by the Rem3 tool.
Logfile of HijackThis v1.99.1
Scan saved at 12:04:27 PM, on 10/21/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
D:\VMware Workstation\vmware-authd.exe
C:\WINDOWS\System32\vmnat.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\YAHOO!\YOP\yop.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Apoint\Apntex.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\YAHOO!\YOP\yop.exe /autostart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s.work4sure.com/c/ge/w4sgeen9.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{47313E96-B4D3-429C-AB3B-CDABDF7A5B17}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{6CAE7395-5097-4B21-838B-80C7FDF0E6DB}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BBC649B-0A49-4BB4-9A48-90FF07F5F8C0}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4FDF768-3383-4A50-8B1A-7F943CB460B5}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{EED20013-830C-47FE-9BA1-663B78A25722}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{FE08B913-1CF8-4256-A643-56B1711871EC}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.118 85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.118 85.255.112.199
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - D:\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - Unknown owner - C:\WINDOWS\System32\vmnat.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -service (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Blade81
Uninstall thru Add/Remove programs:
-support.com
Show hidden files
—————–
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK
Downloading needed applications
——————————-
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update. Don't run AVG yet. Will do it a bit later.
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. Don't run ATF yet. Will do it a bit later.
I recommend you to print/save these instructions since these are quite long and you can't access them while in safe mode.
Running HijackThis
——————-
Start HijackThis, click do a system scan only, check:
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s.work4sure.com/c/ge/w4sgeen9.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{47313E96-B4D3-429C-AB3B-CDABDF7A5B17}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{6CAE7395-5097-4B21-838B-80C7FDF0E6DB}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BBC649B-0A49-4BB4-9A48-90FF07F5F8C0}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4FDF768-3383-4A50-8B1A-7F943CB460B5}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{EED20013-830C-47FE-9BA1-663B78A25722}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{FE08B913-1CF8-4256-A643-56B1711871EC}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.118 85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.118 85.255.112.199
Close all browsers & other windows and click fix checked.
==============================
Reboot into safe mode (press F8 before Windows' loading screen and select safe mode)
Deleting files & folders
————————
Delete following files and folders, if found:
C:\WINDOWS\SYSTEM32\DMDTH.EXE
C:\Program Files\support.com
Running temp cleaner & AVG Anti-Spyware
—————————————
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
Post AVG Anti-Spyware log & a fresh HJT log.
-support.com
Show hidden files
—————–
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK
Downloading needed applications
——————————-
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
- Install AVG Anti-Spyware by double clicking the installer.
- Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
- On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
- Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update. Don't run AVG yet. Will do it a bit later.
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. Don't run ATF yet. Will do it a bit later.
I recommend you to print/save these instructions since these are quite long and you can't access them while in safe mode.
Running HijackThis
——————-
Start HijackThis, click do a system scan only, check:
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s.work4sure.com/c/ge/w4sgeen9.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{47313E96-B4D3-429C-AB3B-CDABDF7A5B17}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{6CAE7395-5097-4B21-838B-80C7FDF0E6DB}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BBC649B-0A49-4BB4-9A48-90FF07F5F8C0}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4FDF768-3383-4A50-8B1A-7F943CB460B5}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{EED20013-830C-47FE-9BA1-663B78A25722}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{FE08B913-1CF8-4256-A643-56B1711871EC}: NameServer = 85.255.115.118,85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.118 85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.118 85.255.112.199
Close all browsers & other windows and click fix checked.
==============================
Reboot into safe mode (press F8 before Windows' loading screen and select safe mode)
Deleting files & folders
————————
Delete following files and folders, if found:
C:\WINDOWS\SYSTEM32\DMDTH.EXE
C:\Program Files\support.com
Running temp cleaner & AVG Anti-Spyware
—————————————
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
- Click on Scanner on the toolbar.
- Click on the Settings tab.
- Under How to act?
- Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
- All checkboxes should be ticked.
- Under Possibly unwanted software:
- All checkboxes should be ticked.
- Under Reports:
- Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
- Select Scan every file.
- Under How to act?
- Click on the Scan tab.
- Click on Complete System Scan to start the scan process.
- Let the program scan the machine.
- When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the
Save Scan Report
button before you did hit the
Apply all Actions
button.- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
[external image: Posted Image]
- When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Post AVG Anti-Spyware log & a fresh HJT log.
jimrod
support.com does not show up on the list of add/remove programs. If I do a search for it, it is listed in the program files.
Blade81
If support.com isn't in uninstall list, skip over that part and continue with rest of instructions. 
Blade81
Jimrod,
are you still there?
jimrod
Hi, I am back. Yes, I am still here. Will get back to working on this this week.
Thanks
illukka
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.
Coyote's Installed programs for prevention:
http://forums.tomcoyote.org/index.php?showtopic=31418
The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.
Visit the CoyoteStore http://TomCoyote.org/coyotestore.php
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.
Coyote's Installed programs for prevention:
http://forums.tomcoyote.org/index.php?showtopic=31418
The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.
Visit the CoyoteStore http://TomCoyote.org/coyotestore.php
LDTate
This topic has been reopened by request of the starter of this topic.
Or it has been moved to the correct forum
jimrod
Sorry took so long to post. Was waiting on reply to email and had not checked forum.
Here is hjt log:
Logfile of HijackThis v1.99.1
Scan saved at 9:56:28 AM, on 12/8/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\wdfmgr.exe
D:\VMware Workstation\vmware-authd.exe
C:\WINDOWS\System32\vmnat.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\YAHOO!\YOP\yop.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\YAHOO!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [dmcmr.exe] C:\WINDOWS\System32\dmcmr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1161451589319
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4FDF768-3383-4A50-8B1A-7F943CB460B5}: NameServer = 206.13.29.12
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - D:\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - Unknown owner - C:\WINDOWS\System32\vmnat.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -service (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Here is hjt log:
Logfile of HijackThis v1.99.1
Scan saved at 9:56:28 AM, on 12/8/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\wdfmgr.exe
D:\VMware Workstation\vmware-authd.exe
C:\WINDOWS\System32\vmnat.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\YAHOO!\YOP\yop.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\YAHOO!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [dmcmr.exe] C:\WINDOWS\System32\dmcmr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1161451589319
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4FDF768-3383-4A50-8B1A-7F943CB460B5}: NameServer = 206.13.29.12
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - D:\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - Unknown owner - C:\WINDOWS\System32\vmnat.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -service (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
jimrod
Other log:
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————
+ Created at: 11:49:16 AM 11/17/2006
+ Scan result:
:mozilla.100:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.101:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.102:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.103:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.104:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.105:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.106:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.107:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.108:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.109:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.110:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.111:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.112:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.113:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.281:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.330:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.332:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.403:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.417:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.533:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.568:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.573:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.96:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.97:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.98:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.99:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1B.tmp -> TrackingCookie.2o7 : Cleaned.
:mozilla.353:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.354:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.201:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.202:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.203:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.204:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.205:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.206:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.369:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.370:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3C.tmp -> TrackingCookie.Adserver : Cleaned.
:mozilla.565:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.566:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.29:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.30:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.38:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.40:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.41:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1C.tmp -> TrackingCookie.Advertising : Cleaned.
:mozilla.56:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1D.tmp -> TrackingCookie.Atdmt : Cleaned.
:mozilla.271:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1E.tmp -> TrackingCookie.Bfast : Cleaned.
:mozilla.405:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq20.tmp -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.17:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.18:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.19:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq23.tmp -> TrackingCookie.Bridgetrack : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq22.tmp -> TrackingCookie.Casalemedia : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq25.tmp -> TrackingCookie.Clickbank : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq26.tmp -> TrackingCookie.Com : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4A.tmp -> TrackingCookie.Commission-junction : Cleaned.
:mozilla.237:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp -> TrackingCookie.Coremetrics : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4C.tmp -> TrackingCookie.Counted : Cleaned.
:mozilla.47:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq29.tmp -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.435:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.436:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.437:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.556:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.557:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.558:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.559:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2C.tmp -> TrackingCookie.Falkag : Cleaned.
:mozilla.368:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2D.tmp -> TrackingCookie.Fastclick : Cleaned.
:mozilla.468:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.471:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.578:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.128:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.26:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.27:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.28:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.299:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.300:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.305:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.418:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.446:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.534:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.535:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.539:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.540:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2A.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2E.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2F.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq30.tmp -> TrackingCookie.Hitbox : Cleaned.
:mozilla.234:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.235:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.236:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.170:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq32.tmp -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.560:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Oewabox : Cleaned.
:mozilla.333:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.334:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.335:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.388:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.114:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.115:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.116:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.118:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.123:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.93:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.94:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.95:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq34.tmp -> TrackingCookie.Questionmarket : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq48.tmp -> TrackingCookie.Realtracker : Cleaned.
:mozilla.408:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.119:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.120:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.121:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.122:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.124:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.184:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.185:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.188:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.190:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.191:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.207:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq21.tmp -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq36.tmp -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.218:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.221:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.222:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.223:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.186:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.187:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.189:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.270:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.541:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.117:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq37.tmp -> TrackingCookie.Tribalfusion : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38.tmp -> TrackingCookie.Valueclick : Cleaned.
:mozilla.173:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.174:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.175:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.226:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq39.tmp -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.219:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.220:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq47.tmp -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.198:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.199:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.200:C:\Documents and Settings\CJ\Application Data\Mozilla\Firefox\Profiles\mbx33gtn.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3D.tmp -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3E.tmp -> TrackingCookie.Zedo : Cleaned.
[676] VM_00920000 -> Trojan.Small.fb : Cleaned with backup (quarantined).
::Report end
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI