What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan Paytime problem

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Grateful for help on this please. I mainly use Firfox and so do not see the effects this has on IE, which I gather is its target. I don't know if Paytime has any effects on anything else apart from trying to change my home page on IE, but it is at least boring to keep having it detected and deleted with Counterspy. Herewith my Hijack This log below.

Regards

Alan

Logfile of HijackThis v1.99.1
Scan saved at 19:39:16, on 19/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\eEBAPI\eEBSVC.exe
C:\Tools\Security\AVG\avgamsvr.exe
C:\Tools\Security\AVG\avgupsvc.exe
C:\Tools\Security\AVG\avgemc.exe
C:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
C:\WINDOWS\system32\GEARSEC.EXE
C:\Tools\Security\Kerio Firewall\persfw.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Tools\Security\CounterSpy\sunThreatEngine.exe
C:\Tools\Security\CounterSpy\SunProtectionServer.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Tools\Security\AVG\avgcc.exe
C:\Tools\Security\CounterSpy\sunserver.exe
E:\Palm\Reading\RepliGo\RepliGoMon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\InkSaver\InkSaver.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Tools\Security\WinPatrol\winpatrol.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Tools\Mouse\MouseWare\system\em_exec.exe
C:\Tools\Netgear\WlanMonitor.exe
E:\WP\EverNote\EverNote.exe
E:\Palm\Handspring\Hotsync.exe
D:\Internet\Downloading\Download Manager\fdm.exe
C:\Tools\File-Ex 3\FileEx.exe
D:\INTERNET\E-MAIL\THUNDERBIRD\THUNDE~1.EXE
D:\INTERNET\BROWSING\FIREFOX\FIREFOX.EXE
E:\FileMan\totalcmd\TOTALCMD.EXE
c:\Tools\Security\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.onesite.info/personals.php?name=almunday
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.onesite.info/personals.php?name=almunday
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.onesite.info/personals.php?name=almunday
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.onesite.info/personals.php?name=almunday
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

c:\secure32.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=
O1 - Hosts: ··
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - blank

(file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: RepliGoIEHelperCtl Class -

{91DE4477-9CDC-4806-9BCB-28A963988E94} -

E:\Palm\Reading\RepliGo\RepliGoIEHelper.dll
O2 - BHO: IeHelper Class - {A491D208-B353-490F-B81A-A8A3DC97042D} -

C:\WINDOWS\system32\smiehlp.dll
O2 - BHO: FDMIECookiesBHO Class -

{CC59E0F9-7E43-44FA-9FAA-8377850BF205} -

D:\Internet\Downloading\Download Manager\iefdmcks.dll
O3 - Toolbar: FreshDownload Bar -

{ED0E8CA5-42FB-4B18-997B-769E0408E79D} - blank (file missing)
O3 - Toolbar: &RepliGo - {81F4066B-F330-4872-8094-3E9FBCCEC8C1} -

E:\Palm\Reading\RepliGo\RepliGoIEBar.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} -

C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: NVRIEbar.IEbar - {BCBF738C-4891-4B9A-959A-C6BF7F608C3A} -

E:\WP\Txt2Speech\NaturalReader\NVRIEBar.dll
O4 - HKLM\..\Run: [FinePrint Dispatcher v5]

"C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [AVG7_CC] C:\Tools\Security\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunServer]

C:\Tools\Security\CounterSpy\sunserver.exe
O4 - HKLM\..\Run: [RepliGo Assistant]

"E:\Palm\Reading\RepliGo\RepliGoMon.exe"
O4 - HKLM\..\Run: [EPSON PictureMate]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0P1.EXE /P17 "EPSON

PictureMate" /O5 "LPT1:" /M "PictureMate"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe

bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [InkSaver] C:\Program Files\InkSaver\InkSaver.exe

hide
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType

Pro\type32.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Tools\Security\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LDM] :C:\Tools\Mouse\\Desktop

Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [APV]

C:\Tools\ProcessViewer\autostart_and_process_viewer.exe
O4 - Startup: MA101 Configuration Utility .lnk = ?
O4 - Startup: EverNote.lnk = E:\WP\EverNote\EverNote.exe
O4 - Startup: HotSync Manager.lnk = E:\Palm\Handspring\Hotsync.exe
O4 - Startup: Free Download Manager.lnk =

D:\Internet\Downloading\Download Manager\fdm.exe
O4 - Startup: File-Ex.lnk = C:\Tools\File-Ex 3\FileEx.exe
O4 - Global Startup: MA101 Configuration Utility .lnk = ?
O4 - Global Startup: EverNote.lnk = D:\WP\EverNote\EverNote.exe
O4 - Global Startup: HotSync Manager.lnk =

D:\Palm\Handspring\Hotsync.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions

present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel

present
O8 - Extra context menu item: &Save To Palm -

E:\Palm\Handspring\HandStoryME.htm
O8 - Extra context menu item: Add to EverNote -

res://E:\WP\EverNote\enbar.dll/2000
O8 - Extra context menu item: C&lip To Palm -

E:\Palm\Handspring\HandStoryMEC.htm
O8 - Extra context menu item: Clip with Sunrise XP -

E:\Palm\Reading\Sunrise XP\msie\clip.html
O8 - Extra context menu item: Download all with Free Download Manager -

file://D:\Internet\Downloading\Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download

Manager - file://D:\Internet\Downloading\Download

Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager -

file://D:\Internet\Downloading\Download Manager\dllink.htm
O8 - Extra context menu item: Open Link Target in Firefox -

file://C:\Documents and Settings\Alan J Munday\Application

Data\Mozilla\Firefox\Profiles\zmbwt0s9.default\extensions\{5D558C43-550

F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: View This Page in Firefox -

file://C:\Documents and Settings\Alan J Munday\Application

Data\Mozilla\Firefox\Profiles\zmbwt0s9.default\extensions\{5D558C43-550

F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O8 - Extra context menu item: ÔÚFoxmailÖÐÌí¼Ó¸ÃRSSƵµÀ/ƵµÀ×é -

res://C:\WINDOWS\system32\fmrsslink.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FreshDownload -

{19C78247-53D0-428E-86AD-59B86A82CBB4} -

C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Save To Palm -

{6C8741AB-53B4-476e-BE7C-F519AD8A6494} -

E:\Palm\Handspring\HandStoryTE.htm
O9 - Extra 'Tools' menuitem: &Save To Palm -

{6C8741AB-53B4-476e-BE7C-F519AD8A6494} -

E:\Palm\Handspring\HandStoryTE.htm
O9 - Extra button: Add to EverNote -

{A5ABA0BB-F195-40d8-A5E9-0801153E6597} - E:\WP\EverNote\enbar.dll
O9 - Extra 'Tools' menuitem: Add to EverNote -

{A5ABA0BB-F195-40d8-A5E9-0801153E6597} - E:\WP\EverNote\enbar.dll
O9 - Extra button: iSiloX Clipper -

{C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} -

E:\Palm\Reading\iSilo\iSiloXIE.dll
O9 - Extra 'Tools' menuitem: iSiloX Clipper… -

{C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} -

E:\Palm\Reading\iSilo\iSiloXIE.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) -

http://download.zonelabs.com/bin/promotion…tor/ICSScanner3

7680.cab
O18 - Protocol: bw+0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B}

- C:\Tools\Mouse\Desktop

Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} -

C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 -

{A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop

Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -

C:\Tools\Security\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -

C:\Tools\Security\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -

C:\Tools\Security\AVG\avgemc.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program

Files\Common Files\EPSON\eEBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO

EPSON CORPORATION - C:\Program Files\Common

Files\EPSON\eEBAPI\SAgent2.exe
O23 - Service: GEARSecurity - GEAR Software -

C:\WINDOWS\system32\GEARSEC.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies -

C:\Tools\Security\Kerio Firewall\persfw.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North

America, Inc. - C:\WINDOWS\system32\RioMSC.exe
Post #2
Hello truthseeker

Copy and Paste this post into a new text document or print it out for reference.

Step 1

Can you please Keep your Real-time Protection software "Disabled" until your system is clean

To Disable WinPatrol's Protection.
Right-click the 'Scotty Dog' icon in the system tray.
UnCheck "Always Run Winpatrol"
When WinPatrol questions the Startup change, click Yes.
Reboot the machine to complete the change.

To Disable CounterSpy Protection.

Click on the "Active Protection" icon.
In the right pane click on Internet Monitors
Click Disable next to the globe icon.
Click the Back button to return to the Active Protection window.
Click on "System Monitors" and then "Disable" next to the graph icon.
Click the Back button again and click on "Application Monitors" and then "Disable" next to the disc icon.
Right click on the CounterSpy system tray icon and select Shutdown CounterSpy


Step 2

Download SmitfraudFix by S!Ri from either of these mirrors to your desktop:

http://siri.urz.free.fr/Fix/SmitfraudFix.zip
http://siri.geekstogo.com/SmitfraudFix.zip

Right click SmitfraudFix.zip and Extract (unzip) the SmitfraudFix folder inside to your desktop.
Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing "1" and press "Enter".
Please copy & paste the SmitfraudFix text file which appears back to me.


Step 3

Please Open Notepad, (Start | Run, type Notepad)
Click Format from the Notepad menu and ensure "Word Wrap" is NOT selected.

Rescan with HijackThis and post

1/ The new HijackThis log
2/ The SmitfraudFix text file

ourwilly
Post #3 last edited
Hello Ourwilly and thank you for your prompt response. Here are the reports as requested.

Regards
Alan


Logfile of HijackThis v1.99.1
Scan saved at 01:49:10, on 20/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\eEBAPI\eEBSVC.exe
C:\Tools\Security\AVG\avgamsvr.exe
C:\Tools\Security\AVG\avgupsvc.exe
C:\Tools\Security\AVG\avgemc.exe
C:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
C:\WINDOWS\system32\GEARSEC.EXE
C:\Tools\Security\Kerio Firewall\persfw.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Tools\Security\AVG\avgcc.exe
E:\Palm\Reading\RepliGo\RepliGoMon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\InkSaver\InkSaver.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Tools\Mouse\MouseWare\system\em_exec.exe
C:\Tools\Netgear\WlanMonitor.exe
D:\INTERNET\BROWSING\FIREFOX\FIREFOX.EXE
E:\FileMan\totalcmd\TOTALCMD.EXE
C:\Tools\Security\CounterSpy\sunThreatEngine.exe
C:\Tools\Security\CounterSpy\SunProtectionServer.exe
C:\WINDOWS\NOTEPAD.EXE
c:\Tools\Security\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.onesite.info/personals.php?name=almunday
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onesite.info/personals.php?name=almunday
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.onesite.info/personals.php?name=almunday
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onesite.info/personals.php?name=almunday
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=
O1 - Hosts: ··
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: RepliGoIEHelperCtl Class - {91DE4477-9CDC-4806-9BCB-28A963988E94} - E:\Palm\Reading\RepliGo\RepliGoIEHelper.dll
O2 - BHO: IeHelper Class - {A491D208-B353-490F-B81A-A8A3DC97042D} - C:\WINDOWS\system32\smiehlp.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Internet\Downloading\Download Manager\iefdmcks.dll
O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - blank (file missing)
O3 - Toolbar: &RepliGo - {81F4066B-F330-4872-8094-3E9FBCCEC8C1} - E:\Palm\Reading\RepliGo\RepliGoIEBar.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: NVRIEbar.IEbar - {BCBF738C-4891-4B9A-959A-C6BF7F608C3A} - E:\WP\Txt2Speech\NaturalReader\NVRIEBar.dll
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [AVG7_CC] C:\Tools\Security\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunServer] C:\Tools\Security\CounterSpy\sunserver.exe
O4 - HKLM\..\Run: [RepliGo Assistant] "E:\Palm\Reading\RepliGo\RepliGoMon.exe"
O4 - HKLM\..\Run: [EPSON PictureMate] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0P1.EXE /P17 "EPSON PictureMate" /O5 "LPT1:" /M "PictureMate"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [InkSaver] C:\Program Files\InkSaver\InkSaver.exe hide
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LDM] :C:\Tools\Mouse\\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [APV] C:\Tools\ProcessViewer\autostart_and_process_viewer.exe
O4 - Startup: MA101 Configuration Utility .lnk = ?
O4 - Startup: EverNote.lnk = E:\WP\EverNote\EverNote.exe
O4 - Startup: HotSync Manager.lnk = E:\Palm\Handspring\Hotsync.exe
O4 - Startup: Free Download Manager.lnk = D:\Internet\Downloading\Download Manager\fdm.exe
O4 - Startup: File-Ex.lnk = C:\Tools\File-Ex 3\FileEx.exe
O4 - Global Startup: MA101 Configuration Utility .lnk = ?
O4 - Global Startup: EverNote.lnk = D:\WP\EverNote\EverNote.exe
O4 - Global Startup: HotSync Manager.lnk = D:\Palm\Handspring\Hotsync.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Save To Palm - E:\Palm\Handspring\HandStoryME.htm
O8 - Extra context menu item: Add to EverNote - res://E:\WP\EverNote\enbar.dll/2000
O8 - Extra context menu item: C&lip To Palm - E:\Palm\Handspring\HandStoryMEC.htm
O8 - Extra context menu item: Clip with Sunrise XP - E:\Palm\Reading\Sunrise XP\msie\clip.html
O8 - Extra context menu item: Download all with Free Download Manager - file://D:\Internet\Downloading\Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://D:\Internet\Downloading\Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://D:\Internet\Downloading\Download Manager\dllink.htm
O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Alan J Munday\Application Data\Mozilla\Firefox\Profiles\zmbwt0s9.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Alan J Munday\Application Data\Mozilla\Firefox\Profiles\zmbwt0s9.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O8 - Extra context menu item: ÔÚFoxmailÖÐÌí¼Ó¸ÃRSSƵµÀ/ƵµÀ×é - res://C:\WINDOWS\system32\fmrsslink.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FreshDownload - {19C78247-53D0-428E-86AD-59B86A82CBB4} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Save To Palm - {6C8741AB-53B4-476e-BE7C-F519AD8A6494} - E:\Palm\Handspring\HandStoryTE.htm
O9 - Extra 'Tools' menuitem: &Save To Palm - {6C8741AB-53B4-476e-BE7C-F519AD8A6494} - E:\Palm\Handspring\HandStoryTE.htm
O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - E:\WP\EverNote\enbar.dll
O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - E:\WP\EverNote\enbar.dll
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - E:\Palm\Reading\iSilo\iSiloXIE.dll
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - E:\Palm\Reading\iSilo\iSiloXIE.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37680.cab
O18 - Protocol: bw+0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {A6CAE3D7-0137-43A1-90D1-AE4DD130282C} - C:\Tools\Mouse\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Tools\Security\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Tools\Security\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Tools\Security\AVG\avgemc.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\eEBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\GEARSEC.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Tools\Security\Kerio Firewall\persfw.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe



SmitFraudFix v2.111

Scan done at 1:41:34.14, 20/10/2006
Run from c:\Tools\Security\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Alan J Munday


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Alan J Munday\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ALANJM~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End
Post #4
Hello truthseeker :)

Copy and Paste this post into a new text document or print it out for reference.

Step 1

Please ensure your Real-Time is not Running…

Please Download AVG Anti-Spyware 7.5
http://www.ewido.net/en/download/

The program should launch automatically after installation. If not, double-click the desktop icon.

Deactivate the "Resident Shield" as this may prevent changes to the registry.
To do this, click "Change State" to the right of the Resident Shield option in the main window.
You will clearly see the status change to Inactive if you have done this correctly.

Now Update AVG Anti-Spyware 7.5
click the "Update" icon from the main menu.
Then click the "Start Update" button.
When you receive the "Update successful" prompt, close Ewido.
Note: If you have any problems with the updater, you can Update AVG Anti-Spyware 7.5 Manually.
Do not Scan with this yet!


Now Download CCleaner
http://www.ccleaner.com/download128.asp

Double click on the file to start the installation of the program.
Select your language and click "OK", then next.
Read the license agreement and click "I Agree".
Click next to use the default install location. Click Install then finish to complete installation.
"Double click" the CCleaner shortcut on the desktop to start the program.
Click "Run Cleaner" to run the program.
Caution: It is not recommended to use the 'Issues' tab as it allegedly find's legitimate items. After it has completed it's process, click Exit.


Please Reboot your System into Safe Mode Shut down your system, then Restart your computer
as soon as it starts booting up again continuously tap F8 from the menu select the option to enter Safe Mode

Re-Scan with HijackThis and place a "checkmark" next to these entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
2 - REG:system.ini: Shell=
O1 - Hosts: ··
O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - blank (file missing)

Do you use protection software that Locks the homepage from changes'
or has the system administrator has put this into place, If not then have HijackThis fix these 06 line
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Make sure all browser and all Windows Explorer windows are closed and select "Fix checked". Exit Hijack This

Navigate to then Right Click on and Delete this Bold File.

c:\secure32.html

Reopen AVG Anti-Spyware 7.5 and click the "Scanner" icon from the main menu.
Click "Complete System Scan" to start scanning.
When the scan completes, click "Recommended action" beneath the results window and select "Quarantine".
Then click the "Apply all actions" button to quarantine everything detected.
Then click Save report > Save report as and save the Report-Scan.txt to your desktop.
Then Reboot back into Normal Mode


Step 2

Please go to 'Add/Remove Programs' and Uninstall Logitech Desktop Messenger from your system

And also Update your Sun Java console - You must Uninstall All old versions of Java first as they are a security threat if left installed. Close any programmes you may have running, ESPECIALLY your web browser. Then using Add/Remove Select any item with Java Runtime Environment (JRE) in the name and uninstall.

Then Reboot your computer…

Now CLICK HERE select the Download button next to "J2SE Runtime Environment (JRE) 5.0 Update 9"
"Accept" the License Agreement Then choose the First download link "Windows Offline Installation, Multi-language". Please note - You must Install this version Offline.


Step 3

Please Re-Scan with Hijack This and post

1/ The new HijackThis log
2/ The AVG Anti-Spyware 7.5 Report-Scan.txt

ourwilly
Post #5
Hello again Our Willey and thanks for your last instructions which I have followed.

I have copied two AVGAS scan reports first. As I had been interrupted and lost track of what I had been doing, a little, I was not too happy about the first report, especially as I made a mistake and failed to delete the negative results in report A. After runing AVGAS again, I got the result as in report B. and was able to delete the URLBlaze problem this time. I don't know where the K-meleon results came from in report A., as I had not run K-meleon for some time. Could something that has entered into K-meleon's profile be a source of my problems?

C. is of course the latest HijackThis report.

Incidentally, by way of feedback, the CCleanup appears to have wiped out the cookie or whatever recording my registration of CounterSpy and my recorded registration code no longer worked. However I have asked Sunbelt for help on this, so hopefully it will be resolved soon. You may want to have a think about what fellow users of CounterSpy might do to aviod this another time, if it is possible. Naturally I am a bit put out on this, but it is just one of those things. The important thing is that I am getting the impression that the Paytime trojan has been killed off, now that the related html file is no longer showing up, touch wood :-).

Anyway, here are the reports for your verdict, and any further advice you may feel is needed.

Regards

Alan

A.
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 16:22:33 21/10/2006

+ Scan result:



HKLM\SOFTWARE\Ran Geva -> Adware.URLBlaze : Ignored.
:mozilla.6:C:\Documents and Settings\Alan J Munday\Application
Data\K-Meleon\default\c5grey4d.slt\cookies.txt -> TrackingCookie.Doubleclick : Ignored.
:mozilla.7:D:\Internet\Browsing\K-meleon\Profiles\default\5393db0t.slt\cookies.txt -> TrackingCookie.Doubleclick : Ignored.
:mozilla.29:D:\Internet\Browsing\K-meleon\Profiles\default\5393db0t.slt\cookies.txt -> TrackingCookie.Overture : Ignored.
:mozilla.30:D:\Internet\Browsing\K-meleon\Profiles\default\5393db0t.slt\cookies.txt -> TrackingCookie.Overture : Ignored.


::Report end

B.
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 21:51:54 21/10/2006

+ Scan result:



HKLM\SOFTWARE\Ran Geva -> Adware.URLBlaze : No action taken.


::Report end

C.

Logfile of HijackThis v1.99.1
Scan saved at 22:42:08, on 21/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\eEBAPI\eEBSVC.exe
C:\Tools\Security\AVG Anti-Spyware\guard.exe
C:\Tools\Security\AVG\avgamsvr.exe
C:\Tools\Security\AVG\avgupsvc.exe
C:\Tools\Security\AVG\avgemc.exe
C:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
C:\WINDOWS\system32\GEARSEC.EXE
C:\Tools\Security\Kerio Firewall\persfw.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Tools\Security\AVG\avgcc.exe
C:\Tools\Security\CounterSpy\sunserver.exe
E:\Palm\Reading\RepliGo\RepliGoMon.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Tools\Security\AVG Anti-Spyware\avgas.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Tools\Mouse\MouseWare\system\em_exec.exe
C:\Tools\Netgear\WlanMonitor.exe
E:\WP\EverNote\EverNote.exe
E:\Palm\Handspring\Hotsync.exe
D:\Internet\Downloading\Download Manager\fdm.exe
C:\Tools\File-Ex 3\FileEx.exe
C:\Tools\Security\CounterSpy\sunThreatEngine.exe
C:\Tools\Security\CounterSpy\SunProtectionServer.exe
D:\INTERNET\BROWSING\FIREFOX\FIREFOX.EXE
E:\FileMan\totalcmd\TOTALCMD.EXE
c:\Tools\Security\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.onesite.info/personals.php?name=almunday
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onesite.info/personals.php?name=almunday
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.onesite.info/personals.php?name=almunday
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.onesite.info/personals.php?name=almunday
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onesite.info/personals.php?name=almunday
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.onesite.info/personals.php?name=almunday
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.onesite.info/personals.php?name=almunday
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: RepliGoIEHelperCtl Class - {91DE4477-9CDC-4806-9BCB-28A963988E94} - E:\Palm\Reading\RepliGo\RepliGoIEHelper.dll
O2 - BHO: IeHelper Class - {A491D208-B353-490F-B81A-A8A3DC97042D} - C:\WINDOWS\system32\smiehlp.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Internet\Downloading\Download Manager\iefdmcks.dll
O3 - Toolbar: &RepliGo - {81F4066B-F330-4872-8094-3E9FBCCEC8C1} - E:\Palm\Reading\RepliGo\RepliGoIEBar.dll
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [AVG7_CC] C:\Tools\Security\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunServer] C:\Tools\Security\CounterSpy\sunserver.exe
O4 - HKLM\..\Run: [RepliGo Assistant] "E:\Palm\Reading\RepliGo\RepliGoMon.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Tools\Security\AVG Anti-Spyware\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [APV] C:\Tools\ProcessViewer\autostart_and_process_viewer.exe
O4 - Startup: MA101 Configuration Utility .lnk = ?
O4 - Startup: EverNote.lnk = E:\WP\EverNote\EverNote.exe
O4 - Startup: HotSync Manager.lnk = E:\Palm\Handspring\Hotsync.exe
O4 - Startup: Free Download Manager.lnk = D:\Internet\Downloading\Download Manager\fdm.exe
O4 - Startup: File-Ex.lnk = C:\Tools\File-Ex 3\FileEx.exe
O4 - Global Startup: MA101 Configuration Utility .lnk = ?
O4 - Global Startup: EverNote.lnk = D:\WP\EverNote\EverNote.exe
O4 - Global Startup: HotSync Manager.lnk = D:\Palm\Handspring\Hotsync.exe
O8 - Extra context menu item: &Save To Palm - E:\Palm\Handspring\HandStoryME.htm
O8 - Extra context menu item: Add to EverNote - res://E:\WP\EverNote\enbar.dll/2000
O8 - Extra context menu item: C&lip To Palm - E:\Palm\Handspring\HandStoryMEC.htm
O8 - Extra context menu item: Clip with Sunrise XP - E:\Palm\Reading\Sunrise XP\msie\clip.html
O8 - Extra context menu item: Download all with Free Download Manager - file://D:\Internet\Downloading\Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://D:\Internet\Downloading\Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://D:\Internet\Downloading\Download Manager\dllink.htm
O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Alan J Munday\Application Data\Mozilla\Firefox\Profiles\zmbwt0s9.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Alan J Munday\Application Data\Mozilla\Firefox\Profiles\zmbwt0s9.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O8 - Extra context menu item: ÔÚFoxmailÖÐÌí¼Ó¸ÃRSSƵµÀ/ƵµÀ×é - res://C:\WINDOWS\system32\fmrsslink.dll/201
O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - E:\WP\EverNote\enbar.dll
O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - E:\WP\EverNote\enbar.dll
O9 - Extra button: iSiloX Clipper - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - E:\Palm\Reading\iSilo\iSiloXIE.dll
O9 - Extra 'Tools' menuitem: iSiloX Clipper… - {C86027A6-12A1-4298-B6EA-A42AC6EE6C7C} - E:\Palm\Reading\iSilo\iSiloXIE.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37680.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Tools\Security\AVG Anti-Spyware\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Tools\Security\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Tools\Security\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Tools\Security\AVG\avgemc.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\eEBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\GEARSEC.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Tools\Security\Kerio Firewall\persfw.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
Post #6
Hello truthseeker :)

Thank you for the feedback, I would like to do another check if you don't mind.

Can you Please Use 'Internet Explorer' to run The Panda Online Scan
http://www.pandasoftware.com/products/activescan.htm

Once you are on the Panda site click the Scan your PC button.
A new window will open…click the Check Now button.
Enter your Country.
Enter your State/Province.
Enter your e-mail address and click send.
Select either Home User or Company.
Click the big Scan Now button.
If it wants to install an ActiveX component, allow it to.
It will start downloading the files it requires for the scan (Note: It may take a minute or two).
When download is complete, click on Local Disks to start the scan.
When the scan completes, click the See Report button, then Save Report, and save it to your desktop.

Reboot your System

Can you please post The Online Panda Result's and please let me know how your system is running now.

Thank you,
ourwilly. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI