What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

amaena, Winantivirus got me

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Run Hijack This!.

Click on Open Misc Tools section

To the right of Generate Startuplist log, there are two boxes.

Check them both, then click Generate Startuplist log.

"Copy/paste" the startuplist log into this thread.
Post #17
HJT Start up log

StartupList report, 11/20/2006, 11:02:48 AM
StartupList version: 1.52.2
Started from : C:\HJT\seeme.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\seeme.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Debra\Start Menu\Programs\Startup]
LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

S3TRAY2 = S3Tray2.exe
SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
BluetoothAuthenticationAgent = rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
TpShocks = TpShocks.exe
TPHOTKEY = C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
BMMLREF = C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
TPKMAPHELPER = C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
TP4EX = tp4ex.exe
EZEJMNAP = C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
AGRSMMSG = AGRSMMSG.exe
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
frymxins = "C:\Program Files\ATI Technologies\Fire GL 3D Studio Max\atiimxgl"
ATIModeChange = Ati2mdxx.exe
UC_Start = C:\IBMTools\Updater\ucstartup.exe
ibmmessages = C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
UpdateManager = "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
dla = C:\WINDOWS\system32\dla\tfswctrl.exe
QCWLICON = C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
BMMGAG = RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Logitech Utility = Logi_MwX.Exe
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
vptray = C:\PROGRA~1\SYMANT~1\VPTray.exe
SunJavaUpdateSched = "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
!AVG Anti-Spyware = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

IBM RecordNow! =
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
tgcmd =
ibmmessages = C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
swg = C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
RealPlayer = "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\WINDOWS\system32\dla\tfswshx.dll - {5CA3D70E-1895-11CF-8E15-001234567890}
(no name) - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - c:\program files\google\googletoolbar1.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}

————————————————–

Enumerating Task Scheduler jobs:

AppleSoftwareUpdate.job
BMMTask.job

————————————————–

Enumerating Download Program Files:

[QuickTime Object]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\System32\macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwa…director/sw.cab

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdat…b?1161121531800

[IBM Access Support]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\IbmEgath.dll
CODEBASE = http://www-307.ibm.com/pc/support/IbmEgath.cab

[IASRunner Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\ACPIR.dll
CODEBASE = https://www.ibm.com/pc/support/access/aslib…ntent/AcpIR.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa…ash/swflash.cab

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

————————————————–
End of report, 8,526 bytes
Report generated in 0.080 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
Post #18
Please go here:

Silent Runners.org

Download/run the silentrunners.vbs script.

If your antivirus complains about it, just tell it to allow this script - It's safe.

When you run it, click "Yes" to the "Skip supplementary searches".

It will take a few minutes to run.

When it fininshes, it will tell you what text file it put the results in (it will be in the same folder the VBS file was downloaded into).

Open it up with Notepad, and paste it into your next post, please.
:)
Post #19
Silent Runner Script

"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
———————————

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"IBM RecordNow!" = "(empty string)" [file not found]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"tgcmd" = "(empty string)" [file not found]
"ibmmessages" = "C:\Program Files\IBM\Messages By IBM\ibmmessages.exe" ["IBM"]
"swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe" ["Google Inc."]
"RealPlayer" = ""C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot" ["RealNetworks, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"S3TRAY2" = "S3Tray2.exe" ["S3 Graphics, Inc."]
"SynTPLpr" = "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" ["Synaptics, Inc."]
"SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."]
"BluetoothAuthenticationAgent" = "rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent" [MS]
"TpShocks" = "TpShocks.exe" ["IBM Corp."]
"TPHOTKEY" = "C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [null data]
"BMMLREF" = "C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [null data]
"TPKMAPHELPER" = "C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper" ["IBM Corp."]
"TP4EX" = "tp4ex.exe" ["IBM Corporation"]
"EZEJMNAP" = "C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" ["IBM Corp."]
"AGRSMMSG" = "AGRSMMSG.exe" ["Agere Systems"]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"frymxins" = ""C:\Program Files\ATI Technologies\Fire GL 3D Studio Max\atiimxgl"" ["ATI Technologies, Inc."]
"ATIModeChange" = "Ati2mdxx.exe" ["ATI Technologies, Inc."]
"UC_Start" = "C:\IBMTools\Updater\ucstartup.exe" [null data]
"ibmmessages" = "C:\Program Files\IBM\Messages By IBM\ibmmessages.exe" ["IBM"]
"UpdateManager" = ""c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r" ["Sonic Solutions"]
"dla" = "C:\WINDOWS\system32\dla\tfswctrl.exe" ["Sonic Solutions"]
"QCWLICON" = "C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE" ["IBM Corp."]
"BMMGAG" = "RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor" [MS]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"Logitech Utility" = "Logi_MwX.Exe" ["Logitech Inc."]
"ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"vptray" = "C:\PROGRA~1\SYMANT~1\VPTray.exe" ["Symantec Corporation"]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."]
"!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."]
"(Default)" = (unknown data type)

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM…CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM…CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{5CA3D70E-1895-11CF-8E15-001234567890}\(Default) = "*\" (unwritable string)
-> {HKLM…CLSID} = "DriveLetterAccess"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM…CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM…CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {HKLM…CLSID} = "Display Panning CPL Extension"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {HKLM…CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
-> {HKLM…CLSID} = "RecordNow! SendToExt"
\InProcServer32\(Default) = "c:\Program Files\IBM RecordNow!\shlext.dll" [null data]
"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"
-> {HKLM…CLSID} = "DriveLetterAccess"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM…CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM…CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM…CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions"
-> {HKLM…CLSID} = "VpshellEx Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM…CLSID} = "iTunes"
\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM…CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
-> {HKLM…CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
<> NavLogon\DLLName = "C:\WINDOWS\System32\NavLogon.dll" ["Symantec Corporation"]
Post #21
Right after I open Explorer, within one minute I get Drivecleaner, Winantivirus, or amaena.com pop-up. I am running Smyantec which will catch (partial) drivecleaner, nothing else. The only blocker is the one on my google toolbar, it does'nt catch any of the three.
Post #22
Download WinPFind

Winpfind.zip

Extract it to the root folder of drive C ( C:\ ). This will create a folder called WinPFind in the C:\ folder. Inside C:\WinPFind is a file called WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

When it is done, it will show the results of the scan. Click on the Copy to Clipboard button and then paste the contents of the log in your clipboard. Then copy/paste it into your next post.

It will probably take more that one post to get it all.

Be sure the entire contents are posted into this thread.
Post #23
Split in two replies

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows sometimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Logfile created on: 11/20/2006 1:52:40 PM
WinPFind v1.5.0 Folder = C:\WinPFind\WinPFind\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2900.2180)

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder…

Checking %ProgramFilesDir% folder…

Checking %WinDir% folder…

Checking %System% folder…
PEC2 8/18/2001 5:00:00 AM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc ()
PTech 5/17/2006 1:23:38 PM 579888 C:\WINDOWS\SYSTEM32\LegitCheckControl.dll (Microsoft Corporation)
UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com ()
PECompact2 11/7/2006 8:38:14 PM 10342824 C:\WINDOWS\SYSTEM32\MRT.exe (Microsoft Corporation)
aspack 11/7/2006 8:38:14 PM 10342824 C:\WINDOWS\SYSTEM32\MRT.exe (Microsoft Corporation)
WSUD 8/4/2004 2:56:54 AM 1200128 C:\WINDOWS\SYSTEM32\ntbackup.exe (Microsoft Corporation)
aspack 8/4/2004 2:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll (Microsoft Corporation)
WSUD 8/4/2004 2:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl (Microsoft Corporation)
aspack 9/25/2003 2:56:10 PM 1375232 C:\WINDOWS\SYSTEM32\ONE2ONE.ocx ()
Umonitor 8/4/2004 2:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll (Microsoft Corporation)
UPX! 1/20/2005 1:47:50 PM 175616 C:\WINDOWS\SYSTEM32\strings.exe ()
WSUD 1/20/2005 1:47:50 PM 175616 C:\WINDOWS\SYSTEM32\strings.exe ()
winsync 8/18/2001 5:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu ()

Checking %System%\Drivers folder and sub-folders…
PTech 8/4/2004 12:41:38 AM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys (Smart Link)

Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days…
11/20/2006 10:58:26 AM S 2048 C:\WINDOWS\bootstat.dat ()
10/9/2006 4:59:58 PM H 0 C:\WINDOWS\inf\oem21.inf ()
10/9/2006 5:01:24 PM H 0 C:\WINDOWS\inf\oem22.inf ()
10/18/2006 6:54:12 AM H 0 C:\WINDOWS\inf\oem23.inf ()
11/9/2006 2:51:40 PM RHS 68327 C:\WINDOWS\PCHealth\HelpCtr\PackageStore\package_10.cab ()
11/9/2006 2:50:20 PM RHS 305145 C:\WINDOWS\PCHealth\HelpCtr\PackageStore\package_9.cab ()
10/16/2006 10:35:46 AM S 10965 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB920213.cat ()
10/13/2006 7:55:52 AM S 10965 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB923980.cat ()
10/13/2006 8:33:10 AM S 10259 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB924270.cat ()
11/20/2006 11:23:26 AM H 1024 C:\WINDOWS\system32\config\default.LOG ()
11/20/2006 10:59:24 AM H 1024 C:\WINDOWS\system32\config\SAM.LOG ()
11/20/2006 11:59:30 AM H 1024 C:\WINDOWS\system32\config\SECURITY.LOG ()
11/20/2006 1:53:52 PM H 1024 C:\WINDOWS\system32\config\software.LOG ()
11/20/2006 1:00:40 PM H 1024 C:\WINDOWS\system32\config\system.LOG ()
11/16/2006 11:37:40 AM H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG ()
11/9/2006 2:50:22 PM S 558 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 ()
11/9/2006 2:50:22 PM S 144 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 ()
10/16/2006 10:20:32 AM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\3508bdc7-dc73-4e7a-a5f9-7017f2f24079 ()
10/16/2006 10:20:32 AM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred ()
11/20/2006 10:58:30 AM H 6 C:\WINDOWS\Tasks\SA.DAT ()

Checking for CPL files…
8/4/2004 2:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl (Microsoft Corporation)
5/16/2003 9:12:58 AM 393216 C:\WINDOWS\SYSTEM32\IBMJavaPlugin141.cpl (IBM)
8/4/2004 2:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl (Microsoft Corporation)
7/26/2006 5:03:14 AM 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl (Sun Microsystems, Inc.)
8/18/2001 5:00:00 AM 187904 C:\WINDOWS\SYSTEM32\main.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl (Microsoft Corporation)
8/18/2001 5:00:00 AM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl (Microsoft Corporation)
8/18/2001 5:00:00 AM 36864 C:\WINDOWS\SYSTEM32\nwc.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl (Microsoft Corporation)
8/18/2001 5:00:00 AM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl (Microsoft Corporation)
8/4/2004 2:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl (Microsoft Corporation)
9/4/2002 4:05:00 AM 61440 C:\WINDOWS\SYSTEM32\tp4ex.cpl (IBM Corporation)
7/3/2003 4:34:00 AM 34816 C:\WINDOWS\SYSTEM32\TP98.CPL (IBM Corp.)
7/19/2003 3:03:26 AM 106496 C:\WINDOWS\SYSTEM32\TpShCPL.cpl (IBM Corp.)
8/4/2004 2:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl (Microsoft Corporation)
5/26/2005 6:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl (Microsoft Corporation)
8/18/2001 5:00:00 AM 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl (Microsoft Corporation)
8/18/2001 5:00:00 AM 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl (Microsoft Corporation)

Checking for Downloaded Program Files…
{00000075-9980-0010-8000-00AA00389B71} - - CodeBase = http://codecs.microsoft.com/codecs/i386/voxacm.CAB
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - QuickTime Object - CodeBase = http://www.apple.com/qtactivex/qtplugin.cab
{166B1BCA-3F9C-11CF-8075-444553540000} - Shockwave ActiveX Control - CodeBase = http://download.macromedia.com/pub/shockwa…director/sw.cab
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - MUWebControl Class - CodeBase = http://update.microsoft.com/microsoftupdat…b?1161121531800
{74FFE28D-2378-11D5-990C-006094235084} - IBM Access Support - CodeBase = http://www-307.ibm.com/pc/support/IbmEgath.cab
{76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} - IASRunner Class - CodeBase = https://www.ibm.com/pc/support/access/aslib…ntent/AcpIR.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} - Java Plug-in 1.5.0_08 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab
{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - Java Plug-in 1.5.0_08 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} - - CodeBase = http://download.macromedia.com/pub/shockwa…ash/swflash.cab

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder…
2/20/2003 12:14:10 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini ()
3/31/2004 11:20:34 AM 1741 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk ()

Checking files in %ALLUSERSPROFILE%\Application Data folder…
2/20/2003 12:03:14 PM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini ()

Checking files in %USERPROFILE%\Startup folder…
2/20/2003 12:14:10 PM HS 84 C:\Documents and Settings\Debra\Start Menu\Programs\Startup\desktop.ini ()
10/8/2006 2:24:04 PM 1549 C:\Documents and Settings\Debra\Start Menu\Programs\Startup\LimeWire On Startup.lnk ()

Checking files in %USERPROFILE%\Application Data folder…
2/20/2003 12:03:14 PM HS 62 C:\Documents and Settings\Debra\Application Data\desktop.ini ()
11/6/2006 4:22:00 PM 35520 C:\Documents and Settings\Debra\Application Data\GDIPFONTCACHEV1.DAT ()

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

>>> Internet Explorer Settings <<<


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
\\Start Page - http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home
\\Search Page - http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
\\Default_Page_URL - http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
\\Default_Search_URL - http://www.google.com/ie
\\Local Page - %SystemRoot%\system32\blank.htm

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main]
\\Start Page - http://www.foxnews.com/
\\Search Bar - http://www.google.com/ie
\\Search Page - http://www.google.com
\\Local Page - C:\WINDOWS\system32\blank.htm

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
\\CustomizeSearch - http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
\\SearchAssistant - http://www.google.com/ie

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search]
\\SearchAssistant - http://www.google.com/ie

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
\\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Microsoft Url Search Hook = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation)

>>> BHO's <<<
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
\{53707962-6F74-2D53-2644-206D7942484F} - = C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
\{5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess = C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - SSVHelper Class = C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll (Sun Microsystems, Inc.)
\{AA58ED58-01DD-4d91-8333-CF10577473F7} - Google Toolbar Helper = c:\program files\google\googletoolbar1.dll (Google Inc.)

>>> Internet Explorer Bars, Toolbars and Extensions <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
\{4D5C8C25-D075-11d0-B416-00C04FB90376} - &Tip of the Day = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation)

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
\{32683183-48a0-441b-a342-7c2a440a9478} - = ()

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google = c:\program files\google\googletoolbar1.dll (Google Inc.)

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
\ShellBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Address = %SystemRoot%\System32\browseui.dll (Microsoft Corporation)
\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - = ()
\WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Address = %SystemRoot%\System32\browseui.dll (Microsoft Corporation)
\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383} - &Links = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation)
\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} - &Google = c:\program files\google\googletoolbar1.dll (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\CmdMapping]
\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 8192 = IBM Java Console
\\NEXTID - 8195
\\{FB5F1910-F110-11d2-BB9E-00C04F795683} - 8194 = Windows Messenger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - MenuText: IBM Java Console = ()
\{FB5F1910-F110-11d2-BB9E-00C04F795683} - ButtonText: Messenger = C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

>>> Approved Shell Extensions (Non-Microsoft Only) <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
\\{42071714-76d4-11d1-8b24-00a0c9068ff3} - Display Panning CPL Extension = deskpan.dll ()
\\{764BF0E1-F219-11ce-972D-00AA00A14F56} - Shell extensions for file compression = ()
\\{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} - Encryption Context Menu = ()
\\{88895560-9AA2-1069-930E-00AA0030EBC8} - HyperTerminal Icon Ext = C:\WINDOWS\System32\hticons.dll (Hilgraeve, Inc.)
\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} - Taskbar and Start Menu = ()
\\{32683183-48a0-441b-a342-7c2a440a9478} - Media Band = ()
\\{7A9D77BD-5403-11d2-8785-2E0420524153} - User Accounts = ()
\\{DEE12703-6333-4D4E-8F34-738C4DCC2E04} - RecordNow! SendToExt = c:\Program Files\IBM RecordNow!\shlext.dll ()
\\{5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess = C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
\\{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - Shell Extensions for RealOne Player = C:\Program Files\Real\RealPlayer\rpshell.dll (RealNetworks, Inc.)
\\{BDA77241-42F6-11d0-85E2-00AA001FE28C} - LDVP Shell Extensions = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll (Symantec Corporation)
\\{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} - iTunes = C:\Program Files\iTunes\iTunesMiniPlayer.dll (Apple Computer, Inc.)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

>>> Context Menu Handlers (Non-Microsoft Only) <<<
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers]
\AVG Anti-Spyware - {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll (Anti-Malware Development a.s.)
\LDVPMenu - {BDA77241-42F6-11d0-85E2-00AA001FE28C} = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll (Symantec Corporation)

[HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers]

[HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers]
\AVG Anti-Spyware - {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll (Anti-Malware Development a.s.)

[HKEY_LOCAL_MACHINE\Software\Classes\Directory\BackGround\shellex\ContextMenuHandlers]

[HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers]
\LDVPMenu - {BDA77241-42F6-11d0-85E2-00AA001FE28C} = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll (Symantec Corporation)

>>> Column Handlers (Non-Microsoft Only) <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]

>>> Registry Run Keys <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
S3TRAY2 - C:\WINDOWS\SYSTEM32\S3Tray2.exe (S3 Graphics, Inc.)
SynTPLpr - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
SynTPEnh - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
BluetoothAuthenticationAgent - C:\WINDOWS\SYSTEM32\rundll32.exe (Microsoft Corporation)
TpShocks - C:\WINDOWS\SYSTEM32\TpShocks.exe (IBM Corp.)
TPHOTKEY - C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe ()
BMMLREF - C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE ()
TPKMAPHELPER - C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe (IBM Corp.)
TP4EX - C:\WINDOWS\SYSTEM32\tp4ex.exe (IBM Corporation)
EZEJMNAP - C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe (IBM Corp.)
AGRSMMSG - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
ATIPTA - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
frymxins - C:\Program Files\ATI Technologies\Fire GL 3D Studio Max\atiimxgl.exe (ATI Technologies, Inc.)
ATIModeChange - C:\WINDOWS\SYSTEM32\Ati2mdxx.exe (ATI Technologies, Inc.)
UC_Start - C:\IBMTools\Updater\ucstartup.exe ()
ibmmessages - C:\Program Files\IBM\Messages By IBM\ibmmessages.exe (IBM)
UpdateManager - c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
dla - C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions)
QCWLICON - C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE (IBM Corp.)
BMMGAG - RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll ()
TkBellExe - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
Logitech Utility - C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.)
ccApp - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
vptray - C:\PROGRA~1\SYMANT~1\VPTray.exe (Symantec Corporation)
SunJavaUpdateSched - C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe (Sun Microsystems, Inc.)
QuickTime Task - C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
iTunesHelper - C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
!AVG Anti-Spyware - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe (Anti-Malware Development a.s.)
!AVG Anti-Spyware - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe (Anti-Malware Development a.s.)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1
Post #24
2nd post [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] IBM RecordNow! - Reg Data missing or invalid () MSMSGS - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) tgcmd - Reg Data missing or invalid () ibmmessages - C:\Program Files\IBM\Messages By IBM\ibmmessages.exe (IBM) swg - C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe (Google Inc.) RealPlayer - C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.) [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] >>> Startup Links <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\\Common Startup] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini () C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\\Startup] C:\Documents and Settings\Debra\Start Menu\Programs\Startup\desktop.ini () C:\Documents and Settings\Debra\Start Menu\Programs\Startup\LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe () >>> MSConfig Disabled Items <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig] [All Users Startup Folder Disabled Items] [Current User Startup Folder Disabled Items] >>> User Agent Post Platform <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] \\SV1 - >>> AppInit Dll's <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs] >>> Image File Execution Options <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] \Your Image File Name Here without a path - Debugger = ntsd -d >>> Shell Service Object Delay Load <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] \\PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation) \\CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation) \\WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll (Microsoft Corporation) \\SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll (Microsoft Corporation) >>> Shell Execute Hooks <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] \\{AEB6717E-7E19-11d0-97EE-00C04FD91972} - URL Exec Hook = shell32.dll (Microsoft Corporation) \\{57B86673-276A-48B2-BAE7-C6DBB3020EB8} - CShellExecuteHookImpl Object = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll (Anti-Malware Development a.s.) >>> Shared Task Scheduler <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] \\{438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader = %SystemRoot%\System32\browseui.dll (Microsoft Corporation) \\{8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon = %SystemRoot%\System32\browseui.dll (Microsoft Corporation) >>> Winlogon <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] \\UserInit = C:\WINDOWS\system32\userinit.exe, \\Shell = Explorer.exe \\System = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] \AtiExtEvent - Ati2evxx.dll = () \crypt32chain - crypt32.dll = (Microsoft Corporation) \cryptnet - cryptnet.dll = (Microsoft Corporation) \cscdll - cscdll.dll = (Microsoft Corporation) \NavLogon - C:\WINDOWS\System32\NavLogon.dll = (Symantec Corporation) \ScCertProp - wlnotify.dll = (Microsoft Corporation) \Schedule - wlnotify.dll = (Microsoft Corporation) \sclgntfy - sclgntfy.dll = (Microsoft Corporation) \SensLogn - WlNotify.dll = (Microsoft Corporation) \termsrv - wlnotify.dll = (Microsoft Corporation) \wlballoon - wlnotify.dll = (Microsoft Corporation) >>> DNS Name Servers <<< {88497173-EF48-40AB-9462-E2CFB8350772} - (11a/b/g Wireless LAN Mini PCI Adapter) {DD9D61F8-7A33-4500-B84D-3081806BA52C} - (Intel® PRO/1000 MT Mobile Connection) >>> All Winsock2 Catalogs <<< [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries] \000000000001\\LibraryPath - %SystemRoot%\System32\mswsock.dll (Microsoft Corporation) \000000000002\\LibraryPath - %SystemRoot%\System32\winrnr.dll (Microsoft Corporation) \000000000003\\LibraryPath - %SystemRoot%\System32\mswsock.dll (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries] \000000000001\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000002\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000003\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000004\\PackedCatalogItem - %SystemRoot%\system32\rsvpsp.dll (Microsoft Corporation) \000000000005\\PackedCatalogItem - %SystemRoot%\system32\rsvpsp.dll (Microsoft Corporation) \000000000006\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000007\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000008\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000009\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000010\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000011\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000012\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000013\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) \000000000014\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation) >>> Protocol Handlers (Non-Microsoft Only) <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler] \ipp - () \msdaipp - () >>> Protocol Filters (Non-Microsoft Only) <<< [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter] >>> Selected AddOn's <<< »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Post #25
This is really frustrating….
:rant:

I still can't see anything that could cause pop-ups….
:scratch:

Do you have a firewall other than Windows firewall?
:unsure:

Let's try something else.

Go to this folder:

C:\WINDOWS\system32\drivers\etc

In there is a file named "hosts".

Open it with Notepad.

Towards the bottom of that file, there is a line that will look like this:

127.0.0.1 localhost

Make three more copies of that line, then edit them to look like this:

127.0.0.1 66.244.254.63
127.0.0.1 66.244.254.64
127.0.0.1 204.16.207.50

When finished, the bottom of your "hosts" file will look about like this:

127.0.0.1 localhost
127.0.0.1 66.244.254.63
127.0.0.1 66.244.254.64
127.0.0.1 204.16.207.50

Save the edited hosts file.

Reboot.

Then give a "status" report.
:) :thumbup:
Post #26
The only firewall that I am aware of is Windows, edited the file, rebooted, nothing abnormal. Still had the amaena.com pop-up upon Explorer opening. ??
Post #27
You need another firewall.

This one with Windows only works "one-way".

Meaning it can stop some things from gettin "in", but does nothing to alert you about things getting "out".

Links to free firewalls can be found here:

Securing Your PC After An Attack

Or find one of your own choosing and install it.

Afterwards, let's go another route.

Make sure Internet Explorer is running.

Run Hijackthis.

Click the "Open the Misc Tools section" Button.

Click the "Open process manager" Button.

In the list of processes, find and click on:

C:\Program Files\Internet Explorer\iexplore.exe

It will be highlighted in blue.

Then check the "Show DLL's" box (upper right).

The window will split, with an upper and lower panel, the lower panel containing DLL's associated with Internet Explorer.

Now click floppy disk icon just to the left of "Show DLL's".

This will save the list to a text file.

Copy/paste that list into your next post, and also post a new Hijackthis! log, please.
:)
Post #28
Installed Zone Alarm, still amaena and WinAntivirus getting thru. Here are a new HJT and process list. Hope it helps


Logfile of HijackThis v1.99.1
Scan saved at 9:35:57 PM, on 11/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\seeme.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [frymxins] "C:\Program Files\ATI Technologies\Fire GL 3D Studio Max\atiimxgl"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\IBMTools\Updater\ucstartup.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161121531800
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - https://www.ibm.com/pc/support/access/aslib…ntent/AcpIR.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe




Process list saved on 9:35:30 PM, on 11/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)

[pid] [full path to filename] [file version] [company name]
688 C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation
776 C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation
820 C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation
832 C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation
1008 C:\WINDOWS\System32\ibmpmsvc.exe
1032 C:\WINDOWS\System32\Ati2evxx.exe 6.14.10.4083
1052 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1180 C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1400 C:\WINDOWS\system32\ZoneLabs\vsmon.exe 6.5.737.0 Zone Labs, LLC
1544 C:\WINDOWS\system32\Ati2evxx.exe 6.14.10.4083
1592 C:\WINDOWS\Explorer.EXE 6.0.2900.2180 Microsoft Corporation
260 C:\WINDOWS\system32\spoolsv.exe 5.1.2600.2696 Microsoft Corporation
1948 C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe 3.0.0.160 Symantec Corporation
1224 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 104.0.8.3 Symantec Corporation
188 C:\Program Files\Symantec AntiVirus\DefWatch.exe 10.1.4.4000 Symantec Corporation
396 C:\WINDOWS\System32\QCONSVC.EXE 2.7.2.0 IBM Corp.
716 C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe 2.2.0.7 Symantec Corporation
732 C:\Program Files\Symantec AntiVirus\Rtvscan.exe 10.1.4.4000 Symantec Corporation
140 C:\WINDOWS\system32\TpKmpSVC.exe
1296 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 104.0.8.3 Symantec Corporation
2388 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe 7.5.17.6 Synaptics, Inc.
2396 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 7.5.17.6 Synaptics, Inc.
2412 C:\WINDOWS\system32\TpShocks.exe 1.0.0.1 IBM Corp.
2420 C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
2456 C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe 1.0.0.0 IBM Corp.
2480 C:\WINDOWS\AGRSMMSG.exe 2.1.31.0 Agere Systems
2520 C:\Program Files\IBM\Messages By IBM\ibmmessages.exe 1.1.0.3 IBM
2536 C:\WINDOWS\system32\dla\tfswctrl.exe 1.4.7.0 Sonic Solutions
2552 C:\WINDOWS\system32\RunDll32.exe 5.1.2600.2180 Microsoft Corporation
2560 C:\Program Files\Common Files\Real\Update_OB\realsched.exe 0.1.0.3018 RealNetworks, Inc.
2576 C:\Program Files\Common Files\Symantec Shared\ccApp.exe 104.0.8.3 Symantec Corporation
2592 C:\PROGRA~1\SYMANT~1\VPTray.exe 10.1.4.4000 Symantec Corporation
2604 C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe 5.0.80.3 Sun Microsystems, Inc.
2616 C:\Program Files\QuickTime\qttask.exe 7.1.3.130 Apple Computer, Inc.
2624 C:\Program Files\iTunes\iTunesHelper.exe 7.0.1.8 Apple Computer, Inc.
2696 C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
2704 C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe 1.0.0.1 IBM Corporation
2744 C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.EXE 1.0.0.1 IBM Corporation
2752 C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe 6.5.737.0 Zone Labs, LLC
2812 C:\Program Files\Messenger\msmsgs.exe 4.7.0.3001 Microsoft Corporation
2836 C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe 1.2.908.5008 Google Inc.
2992 C:\Program Files\Logitech\MouseWare\system\em_exec.exe 9.79.25.1 Logitech Inc.
3640 C:\Program Files\iPod\bin\iPodService.exe 7.0.1.8 Apple Computer, Inc.
2144 C:\Program Files\Internet Explorer\iexplore.exe 6.0.2900.2180 Microsoft Corporation
3848 C:\HJT\seeme.exe 1.99.0.1 Soeperman Enterprises Ltd.


DLLs loaded by process C:\Program Files\Internet Explorer\iexplore.exe:

[full path to filename] [file version] [company name]
C:\WINDOWS\system32\ntdll.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\kernel32.dll 5.1.2600.2945 Microsoft Corporation
C:\WINDOWS\system32\msvcrt.dll 7.0.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\USER32.dll 5.1.2600.2622 Microsoft Corporation
C:\WINDOWS\system32\GDI32.dll 5.1.2600.2818 Microsoft Corporation
C:\WINDOWS\system32\SHLWAPI.dll 6.0.2900.2995 Microsoft Corporation
C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\SHDOCVW.dll 6.0.2900.2987 Microsoft Corporation
C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\MSASN1.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\CRYPTUI.dll 5.131.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\WINTRUST.dll 5.131.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\OLEAUT32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\ole32.dll 5.1.2600.2726 Microsoft Corporation
C:\WINDOWS\system32\NETAPI32.dll 5.1.2600.2976 Microsoft Corporation
C:\WINDOWS\system32\WININET.dll 6.0.2900.2995 Microsoft Corporation
C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\VERSION.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\LPK.DLL 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\USP10.dll 1.420.2600.2180 Microsoft Corporation
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll 6.0.2900.2180 Microsoft Corporation
C:\WINDOWS\system32\SHELL32.dll 6.0.2900.2951 Microsoft Corporation
C:\WINDOWS\system32\comctl32.dll 5.82.2900.2982 Microsoft Corporation
C:\WINDOWS\system32\uxtheme.dll 6.0.2900.2180 Microsoft Corporation
C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll 9.79.25.1 Logitech Inc.
C:\WINDOWS\system32\SynTPFcs.dll 7.5.17.6 Synaptics, Inc.
C:\WINDOWS\system32\BROWSEUI.dll 6.0.2900.2995 Microsoft Corporation
C:\WINDOWS\system32\browselc.dll 6.0.2900.2180 Microsoft Corporation
C:\WINDOWS\system32\appHelp.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\CLBCATQ.DLL 2001.12.4414.308 Microsoft Corporation
C:\WINDOWS\system32\COMRes.dll 2001.12.4414.258 Microsoft Corporation
C:\WINDOWS\system32\urlmon.dll 6.0.2900.2995 Microsoft Corporation
C:\WINDOWS\system32\Secur32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\cscui.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\CSCDLL.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\SETUPAPI.dll 5.1.2600.2180 Microsoft Corporation
c:\program files\google\googletoolbar1.dll 4.0.1020.2544 Google Inc.
C:\WINDOWS\system32\msi.dll 3.1.4000.2435 Microsoft Corporation
C:\WINDOWS\system32\WINMM.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\WSOCK32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\WS2_32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\WS2HELP.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\IMM32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\MSIMG32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\msxml3.dll 8.70.1113.0 Microsoft Corporation
C:\WINDOWS\system32\DBGHELP.DLL 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\RASAPI32.DLL 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\rasman.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\TAPI32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\rtutils.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\ntshrui.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\ATL.DLL 3.5.2284.0 Microsoft Corporation
C:\WINDOWS\system32\USERENV.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\msv1_0.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\iphlpapi.dll 5.1.2600.2912 Microsoft Corporation
C:\WINDOWS\system32\sensapi.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\MPR.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\drprov.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\ntlanman.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\NETUI0.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\NETUI1.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\NETRAP.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\SAMLIB.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\davclnt.dll 5.1.2600.2180 Microsoft Corporation
C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll 1.1.0.0 Logitech Inc.
C:\WINDOWS\system32\MSVCP60.dll 6.2.3104.0 Microsoft Corporation
C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll 6.0.1.1091 Adobe Systems Incorporated
C:\PROGRA~1\SPYBOT~1\SDHelper.dll 1.4.0.0 Safer Networking Limited
C:\WINDOWS\system32\olepro32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\dla\tfswshx.dll 1.4.7.0 Sonic Solutions
C:\WINDOWS\system32\tfswapi.dll 1.4.7.0 Sonic Solutions
C:\WINDOWS\system32\dla\tfswcres.dll 1.4.7.0 Sonic Solutions
C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll 5.0.80.3 Sun Microsystems, Inc.
C:\WINDOWS\system32\SXS.DLL 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\shdoclc.dll 6.0.2900.2180 Microsoft Corporation
C:\WINDOWS\system32\xpsp2res.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\mlang.dll 6.0.2900.2180 Microsoft Corporation
C:\WINDOWS\system32\mswsock.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\hnetcfg.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\wshtcpip.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\DNSAPI.dll 5.1.2600.2938 Microsoft Corporation
C:\WINDOWS\system32\rasadhlp.dll 5.1.2600.2938 Microsoft Corporation
C:\WINDOWS\System32\mshtml.dll 6.0.2900.2995 Microsoft Corporation
C:\WINDOWS\System32\msls31.dll 3.10.349.0 Microsoft Corporation
C:\WINDOWS\System32\PSAPI.DLL 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\msimtf.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\MSCTF.dll 5.1.2600.2180 Microsoft Corporation
C:\Program Files\Microsoft Office\Office10\msohev.dll 10.0.2609.0 Microsoft Corporation
c:\windows\system32\jscript.dll 5.6.0.8831 Microsoft Corporation
c:\windows\system32\vbscript.dll 5.6.0.8820 Microsoft Corporation
c:\windows\system32\MFC42.DLL 6.2.4131.0 Microsoft Corporation
C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx 9.0.16.0 Adobe Systems, Inc.
C:\WINDOWS\system32\comdlg32.dll 6.0.2900.2180 Microsoft Corporation
C:\WINDOWS\system32\wdmaud.drv 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\msacm32.drv 5.1.2600.0 Microsoft Corporation
C:\WINDOWS\system32\MSACM32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\midimap.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\system32\schannel.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\ddrawex.dll 5.3.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\DDRAW.dll 5.3.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\DCIMAN32.dll 5.1.2600.2180 Microsoft Corporation
C:\WINDOWS\System32\mshtmled.dll 6.0.2900.2995 Microsoft Corporation
C:\WINDOWS\System32\actxprxy.dll 6.0.2900.2180 Microsoft Corporation
Post #29
SpySweeper
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)
  • If you are taken to the internet page, just close the page.
  • You will be prompted to check for updated definitions, please do so.
    (This may take several minutes)
  • Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.
  • Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!
  • When the sweep has finished, click Remove. Click Select All and then Next
  • From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.
Please post the results from SpySweeper.
Post #30
Spy sweeper log 8:10 AM: Removal process completed. Elapsed time 00:00:09 8:10 AM: Quarantining All Traces: realmedia cookie 8:10 AM: Quarantining All Traces: specificclick.com cookie 8:10 AM: Quarantining All Traces: instant access 8:10 AM: Quarantining All Traces: one2one viewer 8:10 AM: Removal process initiated 8:09 AM: The Internet Communication shield has blocked access to: EM.GAD-NETWORK.COM 8:09 AM: The Internet Communication shield has blocked access to: EM.GAD-NETWORK.COM 8:04 AM: Traces Found: 21 8:04 AM: Full Sweep has completed. Elapsed time 00:47:08 8:04 AM: File Sweep Complete, Elapsed Time: 00:42:49 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\commonname1.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\cydoor4.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\commonname.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\gator.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\cydoor1.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\altnet.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\gator7.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar11.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar10.zip] 8:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar9.zip] 8:03 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\cydoor.zip] 8:02 AM: Warning: AntiVirus engine returned [File Corrupted] on [c:\documents and settings\all users\application data\symantec\liveupdate\downloads\1160927342jtun_sav10enncur25.m25.seg1.zip] 7:59 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\gator5.zip] 7:59 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\tscash.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\gator2.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar8.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar7.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar6.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar5.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar4.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar3.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\alexarelated.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\avenueainc.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\cydoor3.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\dsoexploit.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\dsoexploit1.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\dsoexploit2.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\dsoexploit3.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\dsoexploit4.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\gator1.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\gator4.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\windowsmediaplayer.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar2.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar1.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\cydoor2.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\mywaymybar.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\altnet1.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\windowsmediaplayer4.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\windowsmediaplayer3.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\windowsmediaplayer2.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\windowsmediaplayer1.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\dsoexploit5.zip] 7:58 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\gator6.zip] 7:58 AM: Warning: Failed to access drive D: 7:58 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\debra\cookies\[removed][1].txt] 7:55 AM: Warning: Failed to open file "c:\documents and settings\debra\cookies\[removed][1].txt". The operation completed successfully 7:55 AM: The Internet Communication shield has blocked access to: EM.GAD-NETWORK.COM 7:55 AM: The Internet Communication shield has blocked access to: EM.GAD-NETWORK.COM 7:51 AM: Warning: Failed to open file "c:\program files\symantec antivirus\savrt\0718nav~.tmp". The operation completed successfully 7:51 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\hiberfil.sys] 7:51 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\pagefile.sys] 7:42 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\lavasoft\ad-aware se personal\skins\ad-aware se default.ask] 7:34 AM: C:\WINDOWS\system32\ONE2ONE.ocx (ID = 71505) 7:31 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 6.0\reader\messages\enu\rdrmsgenu.pdf] 7:31 AM: C:\WINDOWS\tmlpcert2005 (ID = 63918) 7:31 AM: Found Adware: instant access 7:30 AM: C:\WINDOWS\system32\RSAG726D.dll (ID = 71510) 7:27 AM: C:\WINDOWS\system32\RSAG726E.dll (ID = 71511) 7:21 AM: Starting File Sweep 7:21 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00 7:21 AM: c:\documents and settings\debra\cookies\debra@realmedia[1].txt (ID = 3235) 7:21 AM: c:\documents and settings\debra\cookies\[removed][1].txt (ID = 3236) 7:21 AM: Found Spy Cookie: realmedia cookie 7:21 AM: c:\documents and settings\debra\cookies\[removed][2].txt (ID = 3400) 7:21 AM: Found Spy Cookie: specificclick.com cookie 7:21 AM: Starting Cookie Sweep 7:21 AM: Registry Sweep Complete, Elapsed Time:00:00:16 7:21 AM: HKCR\typelib\{a6511cdb-606e-4cb7-b1aa-113fec192aa3}\ (ID = 136371) 7:21 AM: HKCR\typelib\{83b8f65d-96e3-4518-a40c-e0ca84ff09fc}\ (ID = 136370) 7:21 AM: HKLM\software\classes\typelib\{a6511cdb-606e-4cb7-b1aa-113fec192aa3}\ (ID = 136367) 7:21 AM: HKLM\software\classes\typelib\{83b8f65d-96e3-4518-a40c-e0ca84ff09fc}\ (ID = 136366) 7:21 AM: HKLM\software\classes\rsx.one2oneviewer\ (ID = 136365) 7:21 AM: HKLM\software\classes\interface\{de1658ef-7963-47e6-bba3-c952798a5ad9}\ (ID = 136364) 7:21 AM: HKLM\software\classes\interface\{ab6e26dd-d437-4e0c-8fb9-719e578e113a}\ (ID = 136363) 7:21 AM: HKLM\software\classes\clsid\{b3a5878e-5b4c-4d12-9156-4d7fd8d0af6c}\ (ID = 136361) 7:21 AM: HKLM\software\classes\clsid\{a1a961da-2ba6-4032-859e-01ac35357163}\ (ID = 136360) 7:21 AM: HKCR\rsx.one2oneviewer\ (ID = 136351) 7:21 AM: HKCR\interface\{de1658ef-7963-47e6-bba3-c952798a5ad9}\ (ID = 136350) 7:21 AM: HKCR\interface\{ab6e26dd-d437-4e0c-8fb9-719e578e113a}\ (ID = 136349) 7:21 AM: HKCR\clsid\{b3a5878e-5b4c-4d12-9156-4d7fd8d0af6c}\ (ID = 136347) 7:21 AM: HKCR\clsid\{a1a961da-2ba6-4032-859e-01ac35357163}\ (ID = 136346) 7:21 AM: Found Adware: one2one viewer 7:21 AM: Starting Registry Sweep 7:21 AM: Memory Sweep Complete, Elapsed Time: 00:03:55 7:21 AM: Warning: AntiVirus engine returned [File Corrupted] on [C:\WINDOWS\system32\] 7:17 AM: Starting Memory Sweep 7:17 AM: Start Full Sweep 7:17 AM: Sweep initiated using definitions version 806 7:17 AM: Spy Sweeper 5.2.3.2125 started 7:17 AM: | Start of Session, Tuesday, November 21, 2006 | ******** 7:17 AM: | End of Session, Tuesday, November 21, 2006 | 7:15 AM: Your definitions are up to date. Operation: File Access Target: Source: C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\DOSCAN.EXE 7:14 AM: Tamper Detection Keylogger: Off BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: On ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: Off 7:14 AM: Shield States 7:13 AM: Spyware Definitions: 790 7:13 AM: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 11/20/2006 9:44:46 AM (GMT) 7:12 AM: Spy Sweeper 5.2.3.2125 started 7:12 AM: Spy Sweeper 5.2.3.2125 started 7:12 AM: | Start of Session, Tuesday, November 21, 2006 | ********

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI