What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

hijackthis log - please help!

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
iv had this virus/trojan/ spyware for three weeks now, tried virius spyware/ anti virus software. some software, during the scan "disables" the popups with a runtime error message popping up .but as soon as the computer is restarted the pop-ups are back, Mcafee anti virus lists the virus as Qhost24 and at location C:\windows\system32\drivers\etc\hosts-qhost24. and states that this file was deleted, however, this message appears everytime i start the computer,so the file obviously isn't being deleted. although when i search for this file the furthest i get is windows\sytem any help on this would be greatly appreciated, iv tried many anti virus/spyware/adware programs but to no avail.

below is a copy of my hijackthis log, i have a more extensive one if its needed,

thanks cailan

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\BigFix\BigFix.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\AOL 9.0\waol.exe
c:\program files\common files\aol\1146385803\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1146385803\ee\aolsoftware.exe
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\aswclnr[1].exe
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\aswclnr[1].tmp
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Documents and Settings\Cailan\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uk.emachines.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://uk.mcafee.com/root/campaign.asp?cid=13364
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [rmalt] C:\Program Files\Systems\Nero7-Keygen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145791432500
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{565A52B1-737A-4CED-A907-8E608A994E8C}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{78079B7F-C810-43DB-B985-331D6DA95C5E}: NameServer = 205.188.146.145
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
Post #2
iv had this virus/trojan/ spyware for three weeks now, tried virius spyware/ anti virus software. some software, during the scan "disables" the popups with a runtime error message popping up .but as soon as the computer is restarted the pop-ups are back, Mcafee anti virus lists the virus as Qhost24 and at location C:\windows\system32\drivers\etc\hosts-qhost24. and states that this file was deleted, however, this message appears everytime i start the computer,so the file obviously isn't being deleted. although when i search for this file the furthest i get is windows\sytem any help on this would be greatly appreciated, iv tried many anti virus/spyware/adware programs but to no avail.

below is a copy of my hijackthis log, i have a more extensive one if its needed,

thanks cailan

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\BigFix\BigFix.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\AOL 9.0\waol.exe
c:\program files\common files\aol\1146385803\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1146385803\ee\aolsoftware.exe
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\aswclnr[1].exe
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\aswclnr[1].tmp
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Documents and Settings\Cailan\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uk.emachines.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://uk.mcafee.com/root/campaign.asp?cid=13364
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [rmalt] C:\Program Files\Systems\Nero7-Keygen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145791432500
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{565A52B1-737A-4CED-A907-8E608A994E8C}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{78079B7F-C810-43DB-B985-331D6DA95C5E}: NameServer = 205.188.146.145
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
Post #3
cailan :D

Welcome to Tom Coyote

Please reply to this thread only by clicking on the [external image: Posted Image] Button and not the NEW TOPIC BUTTON or else your posts will be all over the forum and we won't be able to keep track of you.



I need to see a complete HJT log, I don't even know if your running the latest version. Do this.


Hijackthis 1.99.1
Its important that Hijackthis is installed in its own permanent folder for backup purposes.
  • Go to where you currently have HJT installed and delete the whole folder.
  • Use the link above or the links in my signature to download HJT 1.99.1 setup to your desktop
  • Double Click on the Setup icon and by defaut it will unzip to C:\Program Files\Hijackthis
  • Open HJT Scan and Save a Log File, it will open in Notepad
  • Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread.
  • Please use the [external image: Posted Image] Button and not the New Topic Button
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
Post #4
as requested.. many thanks for your time.

Logfile of HijackThis v1.99.1
Scan saved at 21:18:06, on 19/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\BigFix\BigFix.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
c:\program files\common files\aol\1146385803\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1146385803\ee\aolsoftware.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uk.emachines.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://uk.mcafee.com/root/campaign.asp?cid=13364
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [rmalt] C:\Program Files\Systems\Nero7-Keygen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145791432500
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{565A52B1-737A-4CED-A907-8E608A994E8C}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{78079B7F-C810-43DB-B985-331D6DA95C5E}: NameServer = 205.188.146.145
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
Post #5
Hello cailan :D

You have a trojan on your system, lets do this.


We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Once your system is clean, we suggest that you reverse this to keep critical windows files from accidently being deleted.





Download and install the 30 day trial of AVG Anti-Spyware 7.5 to your desktop.
  • Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run Ewido and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close AVG Anti-Spyware 7.5 <– Do not run the scan yet.




Open HijackThis > Do a System Scan Only, close your browser and all open windows, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O4 - HKLM\..\Run: [rmalt] C:\Program Files\Systems\Nero7-Keygen.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1




Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
Tutorial if you need it How to boot into Safemode


IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch AVG Anti-Spyware 7.5 by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • Ewido will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close AVG Anti-Spyware 7.5




Still in Safemode, look for and delete this file if its present.

C:\Program Files\Systems\Nero7-Keygen.exe




Reboot normally and run this system cleaner

Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up



What I would like you to do is to go into the folder that Hijackthis is in and right click on the HJT icon ( hijackthis.exe ) and rename it to scanner.exe..The reason for this is that there are a couple of infections being written to evade HJT and by renaming it , bad entries may show up on your new log. Then post a new log please.
Post #6
hello ken,

done as asked, thanks for your help so far..

i no longer have popups.. however when i press " ctrl alt del" i get a message telling me "task manager disabled by administrator" something i suspected was the virus?

also i am unable to right click sometimes for instance i could not rightclick over hijackthis.exe to rename it to scanner.exe, instead i had to highlight the file, then file/rename file.. i also cannot right click at desktop to get into properties etc.. i hope this helps you out,
here is the latest HJT log, many thanks again..

cailan


Logfile of HijackThis v1.99.1
Scan saved at 22:21:43, on 20/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\BigFix\BigFix.exe
c:\program files\common files\aol\1146385803\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1146385803\ee\aolsoftware.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Hijackthis\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uk.emachines.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://uk.mcafee.com/root/campaign.asp?cid=13364
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145791432500
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{565A52B1-737A-4CED-A907-8E608A994E8C}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{78079B7F-C810-43DB-B985-331D6DA95C5E}: NameServer = 205.188.146.145
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
Post #7
cailan :D


Lets try a few things.

Open HijackThis > Do a System Scan Only, close your browser and all open windows, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present




Update your Java, the bad guys love to slip into your system by your Java being out of date.
  • Your Java is out of date and leaving your system vulnerable.
  • Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment)
  • It should have an icon next to it:
    [external image: Posted Image]
    Select it and click Remove.
  • Reboot your system.
  • Then go to the Sun Java website and download and install the update.
  • Java Runtime Environment (JRE) 5.0 Update 9 <–This is what you need to download and install.
  • Then after install you can verify your installation here Sun Java Verify




I need to see the report from AVG, you can open the program and go to Reports and post the report into this thread.




Run this free online virus scanner from Panda, it may pick up some bad entires that are not showing up on your HJT log. It's important that I see the log so copy and paste it into your next reply.
Panda ActiveScan <—-Accept default settings




Here are some fixes for Task Manager, if they don't work, when where done here, I can guide you to our own forum for "Other Computer Problems" as well as some others and they are better equipped to help you in the field.
http://windowsxp.mvps.org/Taskmanager_error.htm



So, I need to see the AVG Log, and the Panda log as well as a new HJT log please.
Post #8
Hello Ken,

thanks again for your ongoing help it is much appreciated. :D

your link to the task manager solution page worked a treat :) thanks, i still however cannot right click when on deshtop to set wallpaper/ screensaver settings.. hopefully this may self right on deleting malware..

below, as requested are the panda, then HJT then AVG log files,i have also carried out all steps/ instructions as stated in your last post, thanks

Cailan


PANDA ACTIVESCAN

Incident Status Location

Adware:adware/maxifiles Not disinfected c:\program files\common files\InetGet
Virus:trj/qhost.gen Disinfected Operating system
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@2o7[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Cailan\Cookies\[removed][1].txt

Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@adtech[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@atdmt[2].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@casalemedia[2].txt
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Cailan\Cookies\[removed][1].txt
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Cailan\Cookies\[removed][2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@doubleclick[2].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@fastclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@mediaplex[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@questionmarket[2].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@sextracker[1].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Cailan\Cookies\[removed][2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Cailan\Cookies\cailan@tribalfusion[2].txt
Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\system32\drivers\etc\hosts.bak
Possible Virus. Not disinfected C:\WINDOWS\system32\jesterss.dll



HIJACKTHIS LOG




Logfile of HijackThis v1.99.1
Scan saved at 00:43:28, on 21/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\BigFix\BigFix.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\common files\aol\1146385803\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1146385803\ee\aolsoftware.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Hijackthis\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uk.emachines.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://uk.mcafee.com/root/campaign.asp?cid=13364
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146385803\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145791432500
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS






———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 21:59:35 20/11/2006

+ Scan result:



C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[10].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[11].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[4].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[5].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[6].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[7].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[8].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\F2RNZPJN\popup[9].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\LCVB8NW5\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\LCVB8NW5\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\LCVB8NW5\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\LCVB8NW5\popup[4].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\LCVB8NW5\popup[5].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\LCVB8NW5\popup[6].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\LCVB8NW5\popup[7].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\LCVB8NW5\popup[8].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[10].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[11].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[4].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[5].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[6].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[7].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[8].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\M267T3GW\popup[9].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\MIFY7YQ3\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\MIFY7YQ3\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\MIFY7YQ3\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\MIFY7YQ3\popup[4].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\MIFY7YQ3\popup[5].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Local Settings\Temporary Internet Files\Content.IE5\MIFY7YQ3\popup[6].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[10].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[11].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[12].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[4].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[5].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[6].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[7].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[8].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\0LURG1I3\popup[9].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\6W0HUG1R\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\ATGBUDS3\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\ATGBUDS3\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\ATGBUDS3\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\ATGBUDS3\popup[4].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\ATGBUDS3\popup[5].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\ATGBUDS3\popup[6].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\ATGBUDS3\popup[7].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\E503834H\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\E503834H\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\E503834H\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\GNQTCLKG\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[10].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[11].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[12].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[13].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[14].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[4].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[5].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[6].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[7].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[8].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\KJOR8523\popup[9].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[10].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[11].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[12].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[13].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[14].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[15].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[16].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[17].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[18].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[1].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[2].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[3].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[4].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[5].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[6].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[7].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[8].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Laura\Local Settings\Temporary Internet Files\Content.IE5\WDUDURKZ\popup[9].htm -> Hijacker.Agent.a : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc16.txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@aoluk.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@aoluk.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@heavenlytreasures.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@marksandspencer.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc14.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc15.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc269.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc308.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc405.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc423.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc424.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc461.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc525.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc6.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc861.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc95.txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc199.txt -> TrackingCookie.Aavalue : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc35.txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc45.txt -> TrackingCookie.Adbrite : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc572.txt -> TrackingCookie.Adbrite : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc53.txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc438.txt -> TrackingCookie.Adrevolver : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc52.txt -> TrackingCookie.Adrevolver : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc863.txt -> TrackingCookie.Adserver : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc68.txt -> TrackingCookie.Adtech : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc661.txt -> TrackingCookie.Adtrak : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc71.txt -> TrackingCookie.Advertising : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc72.txt -> TrackingCookie.Adviva : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc110.txt -> TrackingCookie.Atdmt : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc129.txt -> TrackingCookie.Bfast : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc136.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][1].txt -> TrackingCookie.Bpath : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Bpath : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc150.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc38.txt -> TrackingCookie.Clickhype : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc198.txt -> TrackingCookie.Clickzs : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc630.txt -> TrackingCookie.Clickzs : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc171.txt -> TrackingCookie.Com : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc201.txt -> TrackingCookie.Coremetrics : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc588.txt -> TrackingCookie.Coremetrics : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc222.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@enhance[1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@enhance[1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc231.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc232.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc233.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc234.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc235.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc236.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc237.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc238.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc239.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc240.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc241.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc242.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc243.txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc48.txt -> TrackingCookie.Euroclick : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc103.txt -> TrackingCookie.Falkag : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc104.txt -> TrackingCookie.Falkag : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc108.txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc276.txt -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc282.txt -> TrackingCookie.Findwhat : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc122.txt -> TrackingCookie.Goldenpalace : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc314.txt -> TrackingCookie.Goldenpalace : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc726.txt -> TrackingCookie.Goldenpalace : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc252.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc253.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc254.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc255.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc256.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc257.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc258.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc259.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc260.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc261.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc262.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc263.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc264.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc265.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc327.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc328.txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc191.txt -> TrackingCookie.Hitslink : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc331.txt -> TrackingCookie.Hotlog : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@kmpads[1].txt -> TrackingCookie.Kmpads : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@linksynergy[1].txt -> TrackingCookie.Linksynergy : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc527.txt -> TrackingCookie.Liveperson : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc528.txt -> TrackingCookie.Liveperson : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc529.txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc339.txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc394.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc569.txt -> TrackingCookie.Onestat : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc458.txt -> TrackingCookie.Overture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc466.txt -> TrackingCookie.Overture : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc464.txt -> TrackingCookie.Paycounter : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][1].txt -> TrackingCookie.Paypopup : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Paypopup : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc59.txt -> TrackingCookie.Planetactive : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc60.txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@qksrv[1].txt -> TrackingCookie.Qksrv : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc481.txt -> TrackingCookie.Qksrv : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc482.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc571.txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@revenue[1].txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@revenue[1].txt -> TrackingCookie.Revenue : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc492.txt -> TrackingCookie.Revenue : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc497.txt -> TrackingCookie.Roispy : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc249.txt -> TrackingCookie.Ru4 : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc143.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc532.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc197.txt -> TrackingCookie.Sexcounter : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@sexlist[2].txt -> TrackingCookie.Sexlist : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc534.txt -> TrackingCookie.Sexlist : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][2].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@sextracker[2].txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc179.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc180.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc181.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc182.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc183.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc184.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc185.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc186.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc187.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc188.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc189.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc190.txt -> TrackingCookie.Sextracker : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc535.txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc323.txt -> TrackingCookie.Starware : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc612.txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc570.txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc582.txt -> TrackingCookie.Tacoda : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc86.txt -> TrackingCookie.Tacoda : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc584.txt -> TrackingCookie.Targetnet : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc374.txt -> TrackingCookie.Tracking101 : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc606.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc607.txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\Cailan\Cookies\cailan@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc609.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc625.txt -> TrackingCookie.Valueclick : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc639.txt -> TrackingCookie.Web-stat : Cleaned.
C:\Documents and Settings\Laura\Cookies\laura@weborama[1].txt -> TrackingCookie.Weborama : Cleaned.
C:\Documents and Settings\Cailan\Cookies\[removed][2].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\Laura\Cookies\[removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc575.txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc855.txt -> TrackingCookie.Xxxcounter : Cleaned.
C:\RECYCLER\S-1-5-21-24724400-1929723004-3001621874-1007\Dc857.txt -> TrackingCookie
Post #9
Your log looks good :thumbup:

Run ATF Cleaner again, you have a lot of things still in there.

Go to this site
http://www.kellys-korner-xp.com/xp_tweaks.htm


Scroll down to # 285 and click on Restore all display tabs, when the box pops up , click on Run

Make sure that windows is still enabled to show all files and folders and look for this file and tell me if its present. If its missing, that may be why you can't right click to see the tabs. If its missing, I can have you reinstall it. It will most likely be in C:\windows or C:\windows\system32
WindowsShell.Manifest
Post #10
Ah good news at last!, i have ran atf again, and i found the file C:\Windows\WindowsShell.Manifest, so it is present, on the kellys korner link when i click run, on lsaid link at number 285 all i get is "notepad" file with txt instuctions opening, no program actually runs, i have pasted the text below thanks, Cailan Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoActiveDesktopChanges"=hex:00,00,00,00 "NoActiveDesktop"=dword:00000000 "NoSaveSettings"=dword:00000000 "ClassicShell"=dword:00000000 "NoThemesTab"=dword:00000000 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "NoDispAppearancePage"=dword:00000000 "NoColorChoice"=dword:00000000 "NoSizeChoice"=dword:00000000 "NoDispBackgroundPage"=dword:00000000 "NoDispScrSavPage"=dword:00000000 "NoDispCPL"=dword:00000000 "NoVisualStyleChoice"=dword:00000000 "NoDispSettingsPage"=dword:00000000 "NoDispScrSavPage"=dword:00000000 "NoVisualStyleChoice"=dword:00000000 "NoSizeChoice"=dword:00000000 "SetVisualStyle"=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop] "NoChangingWallPaper"=dword:00000000 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager] "ThemeActive"="1" "DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72,00,63,00,65,00,73,00,5c,\ 00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00,75,00,6e,00,61,00,5c,00,\ 6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74,00,79,00,6c,00,65,00,73,\ 00,00,00
Post #11
Cailan :D

You need to use IE for this. Try it again , this time right click Restore all display tabs and select Save Target As and save it to your desktop, Then right click on (restorealldisplaytabs.reg ) and click on Merge.

Reboot and see if this helped.
Post #14
cailan :D

You had an infection on this computer that is now gone, but the downside is that the dirt bags that write this garbage are all Computer Programmer Wanabees and the code they write is not the best. There main purpose is to steal from you, exploit your system by stealing your passwords and account numbers, direct you to there sites for marketing purposes so they get paid and the list goes on. They could care less in the meantime if there garbage damages your system. So when you do get infected, there is always a chance that some damage was left on your system.


If you have your windows CD, you can try running the System File Checker Program, it will scan your system for damaged or missing Operating System files and reinstall them. Depending on how the manufacturer of your system set it up, you may or maynot need the disk. Try it without and if it asks you for it then insert it.


  • Click Start>Run
  • Type in sfc /scannow, hit Enter.
  • Note: there is a space between sfc and /scannow
  • This should replace any corrupted/missing system files and will hopefully fix things.
    You may need your XP disc in your CD drive for this.


This forum is for the removal of malware and viruses and this seems to be a windows issue so I am going to direct you to some great tech support forums for windows including our own at Tom Coyote that are better at dealing with this sort of issue.



IE Freezes
It's Not Always Malware


Windows Tech Support Forums

Tom Coyote <– Our own forum
PcPitStop <– You can take your system in for a checkup here.
Bleeping Computer <–Good XP Forum
Windows Helpnet <– Excellent XP Forum
Hardwareguys <– Another good one

Speedup Windows
TechBuilder


Windows Tips
Techruler
Kellys Korner



Read this and install the programs suggested to help keep you more secure online.

How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

TonyKlein CastleCops
Grinler BleepingComputer
Geeks To Go


I am glad I was able to help you , I hope you can find and answer for the windows problems you have.

Ken :D

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI