What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

sloooo programs..am I infected?

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Rich,

The first two lines of the Rootkit log are false positives so not to worry, but lets clean out your System Restore.

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.
  • Right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
Reboot your System

Turn ON System Restore.
  • Right-click My Computer.
  • ClickProperties.
  • Click the System Restore tab.
  • UN-Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
Create a new Restore Point <– Very Important
  • Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
    You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this


I am wondering if this isn't some sort of software conflict on your system or possibly a hardware failure of some sort.



We can try running the trial of Spysweeper, its very good at finding things that may be hidden. Be sure to download and run the Free Trial and not the free online scan.

Download the Spysweeper 5.2 Free Trial
  • Scroll to the bottom of the page and be sure to download and install the Free 5.2 Trial and not t the free online scan.
  • Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it.
  • If you receive alerts from your firewall, allow all activities for Spy Sweeper
  • You will be prompted to check for updated definitions, please do so.
  • Click on Options > Sweep Options and check Sweep all Folders on Selected drives.
  • Check Local Disc C.
  • Under What to Sweep, check every box.
  • Click on Sweep and allow it to fully scan your system.
  • When the sweep has finished, click Remove. Click Select All and then Next
  • From 'Results', select the Session Log tab.
  • Click Save to File and save the log somewhere convenient.
  • Exit Spy Sweeper.
Restart your computer, and then please copy and paste the SpySweeper log into this thread.


Post the report and a new HJT log and if all is ok, I am going to direct you to some windows support forums that are better at dealing with slow computers.
Post #17
Ken,
sorry for the long delay…really been busy. thanks for the help. new HJT and spysweeper logs are below. the spysweeper takes a long time to open on a restart and took over 24 hrs to scan. is that normal or is the paid copy faster? is there any one program that you prefer or just a combo of entrees such as i have? also spysweeper keeps trying to connect to the internet to update but says it cannot. I dont have it blocked from doing so as far as I know…any suggestions? thanks again and hoping all is well with you. B)

Logfile of HijackThis v1.99.1
Scan saved at 9:57:56 PM, on 12/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Canon\MultiPASS\mpservic.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\rich\Desktop\scanner.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adb…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup151.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15027/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: MPService - Canon Information Systems - C:\Program Files\Canon\MultiPASS\mpservic.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe



10:34 PM: Removal process completed. Elapsed time 00:01:37
10:33 PM: Quarantining All Traces: specialoffersnetworks
10:33 PM: Quarantining All Traces: sidesearch
10:33 PM: Quarantining All Traces: winad
10:32 PM: Quarantining All Traces: comet cursor
10:32 PM: Quarantining All Traces: cws-aboutblank
10:32 PM: Removal process initiated
3:04 PM: Traces Found: 6
3:04 PM: Full Sweep has completed. Elapsed time 04:41:50
3:04 PM: File Sweep Complete, Elapsed Time: 04:58:32
2:58 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\altnet.zip]
2:58 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\commonname.zip]
2:58 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\euniverseupdmgr.zip]
2:47 PM: Warning: Stream read error
2:12 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\zango1.zip]
2:07 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\clearsearchnet.zip]
2:07 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\callinghomebiz1.zip]
2:05 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\cleveriehookerjeired.zip]
2:03 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\cleveriehookerjeired1.zip]
1:58 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\hyperlinker2.zip]
1:58 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\hyperlinker3.zip]
1:58 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\callinghomebiz.zip]
1:57 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\zango.zip]
1:57 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\isearchtechpowerscan.zip]
1:57 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\specialoffersnetwork.zip]
1:54 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\twaintech.zip]
1:53 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\windowssecuritycenterantivirusoverride.zip]
1:53 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\carpediemvars.zip]
1:52 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\callinghomebiz3.zip]
1:52 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\hyperlinker.zip]
1:52 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\callinghomebiz2.zip]
1:52 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\hyperlinker1.zip]
1:50 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\microsoftwindowssecuritycenterantivirusoverride.zip]
1:45 PM: Warning: Failed to access drive F:
12:15 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\cookies\rich@craigslist[2].txt]
12:13 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\vw7wq2r8\5000001[1].js]
12:13 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\cookies\[removed][3].txt]
12:12 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\vzkb02m9\mp_500[1].js]
12:11 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\cookies\rich@aggregateknowledge[1].txt]
12:10 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\3x90dech\ratingsecondary[1].gif]
12:09 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\ratingsecondary[1].gif]
12:09 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\more_reviews_icon[1].gif]
11:58 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\background_gradient[1]]
11:57 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\3x90dech\d2[3].htm]
11:56 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\vw7wq2r8\img30[1].gif]
11:55 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\cookies\[removed][2].txt]
11:55 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\overstock[1]]
11:34 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\3x90dech\spacer[1].gif]
11:34 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\cookies\[removed][1].txt]
11:33 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\cookies\[removed][2].txt]
11:31 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\hotmail77x19[1].gif]
11:27 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\documents and settings\rich\cookies\[removed][1].txt]
11:15 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\jywj7dk9\search[1].". The operation completed successfully
11:15 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\yp56ni9k\search[1].". The operation completed successfully
11:12 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\pagefile.sys]
11:12 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\hiberfil.sys]
11:08 AM: Warning: AntiVirus engine returned [File Corrupted] on [c:\documents and settings\rich\cookies\rich@ebay[2].txt]
11:07 AM: Warning: Failed to open file "c:\documents and settings\rich\cookies\rich@craigslist[2].txt". The operation completed successfully
11:05 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\vw7wq2r8\5000001[1].js". The operation completed successfully
11:05 AM: Warning: Failed to open file "c:\documents and settings\rich\cookies\[removed][3].txt". The operation completed successfully
11:03 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\vzkb02m9\mp_500[1].js". The operation completed successfully
11:02 AM: Warning: Failed to open file "c:\documents and settings\rich\cookies\rich@aggregateknowledge[1].txt". The operation completed successfully
11:00 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\3x90dech\ratingsecondary[1].gif". The operation completed successfully
11:00 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\ratingsecondary[1].gif". The operation completed successfully
11:00 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\more_reviews_icon[1].gif". The operation completed successfully
10:41 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\background_gradient[1]". The operation completed successfully
10:40 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\3x90dech\d2[3].htm". The operation completed successfully
10:39 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\vw7wq2r8\img30[1].gif". The operation completed successfully
10:38 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\overstock[1]". The operation completed successfully
10:38 AM: Warning: Failed to open file "c:\documents and settings\rich\cookies\[removed][2].txt". The operation completed successfully
10:03 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\3x90dech\spacer[1].gif". The operation completed successfully
10:02 AM: Warning: Failed to open file "c:\documents and settings\rich\cookies\[removed][1].txt". The operation completed successfully
10:01 AM: Warning: Failed to open file "c:\documents and settings\rich\cookies\[removed][2].txt". The operation completed successfully
9:59 AM: Warning: Failed to open file "c:\documents and settings\rich\local settings\temporary internet files\content.ie5\d8wd2ecd\hotmail77x19[1].gif". The operation completed successfully
9:54 AM: Warning: Failed to open file "c:\documents and settings\rich\cookies\[removed][1].txt". The operation completed successfully
9:09 AM: Warning: AntiVirus engine returned [File Corrupted] on [c:\csb\windowsupdate\4.exe]
Operation: File Access
Target:
Source: C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGW.EXE
7:03 AM: Tamper Detection
10:32 PM: IE Tracking Cookies Shield: Removed ic-live cookie
8:32 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\recycler\nprotect\order entry.mdz]
8:32 PM: Warning: Failed to read file "c:\recycler\nprotect\order entry.mdz". "c:\recycler\nprotect\order entry.mdz": File not found
8:10 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\recycler\nprotect\00067389.cfg]
5:51 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:48 PM: Warning: Unable to remove cookie c:\documents and settings\rich\cookies\rich@tacoda[2].txt
5:48 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:48 PM: Warning: Unable to remove cookie c:\documents and settings\rich\cookies\rich@tacoda[2].txt
5:48 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:48 PM: Warning: Unable to remove cookie c:\documents and settings\rich\cookies\rich@tacoda[2].txt
5:48 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:48 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:48 PM: Warning: Unable to remove cookie c:\documents and settings\rich\cookies\rich@tacoda[1].txt
5:48 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:48 PM: Warning: Unable to remove cookie c:\documents and settings\rich\cookies\rich@tacoda[1].txt
5:48 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:48 PM: Warning: Unable to remove cookie c:\documents and settings\rich\cookies\rich@tacoda[1].txt
5:48 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:08 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:08 PM: IE Tracking Cookies Shield: Removed tacoda cookie
5:08 PM: Warning: Unable to remove cookie c:\documents and settings\rich\cookies\rich@tacoda[1].txt
5:08 PM: IE Tracking Cookies Shield: Removed tacoda cookie
3:47 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\recycler\nprotect\memo wizard.wiz]
2:08 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\read0600win_enuyhoo0010.pdf]
1:25 PM: C:\WINDOWS\so_remove.exe (ID = 362204)
1:25 PM: Found Adware: specialoffersnetworks
12:37 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\rdrmsgenu.pdf]
12:24 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\recycler\nprotect\elegant fax.dot]
12:10 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\rdrmsgsplash.pdf]
12:05 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\lavasoft\ad-aware se personal\skins\ad-aware se default.ask]
11:49 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rich\application data\adobe\acrobat\7.0\messages\enu\read0600win_enuyhoo0010.pdf]
11:46 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rich\application data\adobe\acrobat\7.0\messages\enu\read0700win_enuadbe0700.pdf]
11:24 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\websearch\websearchenu.pdf]
10:06 AM: Starting File Sweep
10:06 AM: Warning: Failed to access drive A:
10:06 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
10:06 AM: Starting Cookie Sweep
10:06 AM: Registry Sweep Complete, Elapsed Time:00:00:47
10:06 AM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\main\ || search page_bak (ID = 774883)
10:05 AM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
10:05 AM: Found Adware: sidesearch
10:05 AM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\main\ || search page_bak (ID = 115925)
10:05 AM: Found Adware: cws-aboutblank
10:05 AM: HKLM\software\microsoft\windows\currentversion\uninstall\mediagateway\ (ID = 1026626)
10:05 AM: Found Adware: winad
10:05 AM: HKLM\software\screensavers.com\ (ID = 140569)
10:05 AM: Found Adware: comet cursor
10:05 AM: Starting Registry Sweep
10:05 AM: Memory Sweep Complete, Elapsed Time: 00:15:06
9:50 AM: Starting Memory Sweep
9:50 AM: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
9:50 AM: Start Full Sweep
9:50 AM: Sweep initiated using definitions version 820
9:50 AM: Spy Sweeper 5.2.3.2132 started
9:50 AM: | Start of Session, Thursday, December 14, 2006 |
********
9:50 AM: | End of Session, Thursday, December 14, 2006 |
9:49 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
9:49 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
9:48 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
9:48 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
9:48 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
9:47 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
9:46 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
9:45 AM: IE Tracking Cookies Shield: Removed tacoda cookie
9:45 AM: IE Tracking Cookies Shield: Removed webtrends cookie
9:45 AM: IE Tracking Cookies Shield: On
9:45 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
9:44 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
9:44 AM: Shield States
9:43 AM: Spyware Definitions: 820
9:43 AM: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 12/12/2006 12:29:22 PM (GMT)
9:42 AM: Spy Sweeper 5.2.3.2132 started
7:42 AM: | End of Session, Wednesday, December 13, 2006 |
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
7:41 AM: Shield States
7:41 AM: Spyware Definitions: 820
7:41 AM: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 12/12/2006 12:29:22 PM (GMT)
7:40 AM: Spy Sweeper 5.2.3.2132 started
7:37 AM: None
7:37 AM: Traces Found: 0
7:37 AM: Memory Sweep Complete, Elapsed Time: 00:00:49
7:37 AM: Sweep Canceled
Operation: Terminate
Target: C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
Source: C:\WINDOWS\system32\csrss.exe
7:37 AM: Tamper Detection
7:36 AM: Starting Memory Sweep
7:36 AM: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
7:36 AM: Start Full Sweep
7:36 AM: Sweep initiated using definitions version 820
7:36 AM: Spy Sweeper 5.2.3.2132 started
7:36 AM: | Start of Session, Wednesday, December 13, 2006 |
********
11:12 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\pagefile.sys]
11:11 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\windows\prefetch\fsgk32.exe-185e15e5.pf]
11:08 PM: Warning: AntiVirus engine returned [File Corrupted] on [c:\csb\windowsupdate\4.exe]
5:25 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\recycler\nprotect\order entry.mdz]
5:25 PM: Warning: Failed to read file "c:\recycler\nprotect\order entry.mdz". "c:\recycler\nprotect\order entry.mdz": File not found
5:03 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\recycler\nprotect\00067389.cfg]
1:24 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\recycler\nprotect\memo wizard.wiz]
11:45 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\read0600win_enuyhoo0010.pdf]
11:05 AM: C:\WINDOWS\so_remove.exe (ID = 362204)
11:05 AM: Found Adware: specialoffersnetworks
10:17 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\rdrmsgenu.pdf]
10:04 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\recycler\nprotect\elegant fax.dot]
9:50 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\rdrmsgsplash.pdf]
9:46 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\lavasoft\ad-aware se personal\skins\ad-aware se default.ask]
9:29 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rich\application data\adobe\acrobat\7.0\messages\enu\read0600win_enuyhoo0010.pdf]
9:26 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rich\application data\adobe\acrobat\7.0\messages\enu\read0700win_enuadbe0700.pdf]
9:04 AM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\websearch\websearchenu.pdf]
7:56 AM: Starting File Sweep
7:56 AM: Warning: Failed to access drive A:
7:56 AM: Cookie Sweep Complete, Elapsed Time: 00:00:01
7:56 AM: c:\documents and settings\rich\cookies\rich@tacoda[2].txt (ID = 6444)
7:56 AM: Found Spy Cookie: tacoda cookie
7:56 AM: c:\documents and settings\rich\cookies\[removed][1].txt (ID = 3669)
7:56 AM: Found Spy Cookie: webtrends cookie
7:56 AM: Starting Cookie Sweep
7:56 AM: Registry Sweep Complete, Elapsed Time:00:00:40
7:56 AM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\main\ || search page_bak (ID = 774883)
7:56 AM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
7:56 AM: Found Adware: sidesearch
7:56 AM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\main\ || search page_bak (ID = 115925)
7:56 AM: Found Adware: cws-aboutblank
7:56 AM: HKLM\software\microsoft\windows\currentversion\uninstall\mediagateway\ (ID = 1026626)
7:56 AM: Found Adware: winad
7:56 AM: HKLM\software\screensavers.com\ (ID = 140569)
7:56 AM: Found Adware: comet cursor
7:55 AM: Starting Registry Sweep
7:55 AM: Memory Sweep Complete, Elapsed Time: 00:13:15
7:42 AM: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
7:42 AM: Starting Memory Sweep
7:42 AM: Start Full Sweep
7:42 AM: Sweep initiated using definitions version 820
7:42 AM: Spy Sweeper 5.2.3.2132 started
7:42 AM: | Start of Session, Wednesday, December 13, 2006 |
********
7:36 AM: | End of Session, Wednesday, December 13, 2006 |
7:32 AM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
7:32 AM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
6:32 AM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
6:32 AM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
5:32 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
5:32 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
5:28 AM: Shield States
5:28 AM: Spyware Definitions: 820
5:28 AM: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 12/12/2006 12:29:22 PM (GMT)
5:27 AM: Spy Sweeper 5.2.3.2132 started
5:18 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
5:18 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
5:13 AM: Shield States
5:13 AM: Spyware Definitions: 820
5:13 AM: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 12/12/2006 12:29:22 PM (GMT)
5:12 AM: Spy Sweeper 5.2.3.2132 started
3:53 PM: | End of Session, Tuesday, December 12, 2006 |
3:51 PM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
3:51 PM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
3:49 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
3:49 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
3:48 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
3:47 PM: Shield States
3:46 PM: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 12/12/2006 12:29:22 PM (GMT)
3:46 PM: Spyware Definitions: 804
3:45 PM: Spy Sweeper 5.2.3.2132 started
3:45 PM: Spy Sweeper 5.2.3.2132 started
3:45 PM: | Start of Session, Tuesday, December 12, 2006 |
********
5:10 AM: Sweep Status: 6 Items Found
5:10 AM: Traces Found: 7
5:10 AM: File Sweep Complete, Elapsed Time: 13:11:10
5:10 AM: Sweep Canceled
Operation: Terminate
Target: C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
Source: C:\WINDOWS\system32\csrss.exe
5:10 AM: Tamper Detection
4:52 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
4:51 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
3:52 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
3:51 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
2:52 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
2:51 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
1:52 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
1:51 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
12:52 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
12:51 AM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
12:12 AM: Warning: AntiVirus engine returned [Access Denied] on [c:\recycler\nprotect\memo wizard.wiz]
11:52 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
11:51 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
10:51 PM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
10:51 PM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
9:52 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
9:51 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
8:50 PM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
8:50 PM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
7:57 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\read0600win_enuyhoo0010.pdf]
7:52 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
7:51 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
7:16 PM: C:\WINDOWS\so_remove.exe (ID = 362204)
7:16 PM: Found Adware: specialoffersnetworks
6:52 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
6:51 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
6:25 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\rdrmsgenu.pdf]
6:17 PM: Warning: AntiVirus engine returned [Access Denied] on [c:\recycler\nprotect\elegant fax.dot]
5:59 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\rdrmsgsplash.pdf]
5:54 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\lavasoft\ad-aware se personal\skins\ad-aware se default.ask]
5:52 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
5:51 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
5:37 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rich\application data\adobe\acrobat\7.0\messages\enu\read0600win_enuyhoo0010.pdf]
5:35 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rich\application data\adobe\acrobat\7.0\messages\enu\read0700win_enuadbe0700.pdf]
5:14 PM: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\websearch\websearchenu.pdf]
4:52 PM: Access to Hosts file blocked for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
4:51 PM: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
3:58 PM: Starting File Sweep
3:58 PM: Warning: Failed to access drive A:
3:58 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
3:58 PM: c:\documents and settings\rich\cookies\[removed][1].txt (ID = 3669)
3:58 PM: Found Spy Cookie: webtrends cookie
3:58 PM: Starting Cookie Sweep
3:58 PM: Registry Sweep Complete, Elapsed Time:00:00:19
3:58 PM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\main\ || search page_bak (ID = 774883)
3:58 PM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
3:58 PM: Found Adware: sidesearch
3:58 PM: HKU\S-1-5-21-1708537768-706699826-854245398-1003\software\microsoft\internet explorer\main\ || search page_bak (ID = 115925)
3:58 PM: Found Adware: cws-aboutblank
3:58 PM: HKLM\software\microsoft\windows\currentversion\uninstall\mediagateway\ (ID = 1026626)
3:58 PM: Found Adware: winad
3:58 PM: HKLM\software\screensavers.com\ (ID = 140569)
3:58 PM: Found Adware: comet cursor
3:58 PM: Starting Registry Sweep
3:58 PM: Memory Sweep Complete, Elapsed Time: 00:05:31
3:53 PM: Starting Memory Sweep
3:53 PM: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
3:53 PM: Start Full Sweep
3:53 PM: Sweep initiated using definitions version 820
3:53 PM: Spy Sweeper 5.2.3.2132 started
3:53 PM: | Start of Session, Tuesday, December 12, 2006 |
********
Post #18
no2sun99 :D

Spysweeper got rid of a few things, nothing that would seriously slow your system down. It is also a resource hog so you should uninstall it via the Add-Remove programs. It normally takes less than an hour to run on most systems.


Do this….

Clean out your Temporary Internet files. Proceed like this:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
    Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

Then run this other great cleaner.

If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
Download and Install CCleaner
* Click on Run Cleaner
* Run the Issues Scan < – After it scans your system, when you click on the Fix button and it asks you to backup the Registry..Say Yes
Tutorial for CCleaner


  • Go to Start> All Programs> Assessories > System Tools> Disk Defragmenter. This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.


The rest of your log looks fine, nothing malware or virus related I can see :thumbup:


You may try following some of the tips I posted earlier and you may want to post in a windows support forum, they are better equipped at dealing with slow computers than we are in a malware removal forum.

Ken :D
Post #19
no2sun99 :D

Just to be on the safe side, boot to safemode and make sure you have windows enabled to show all files and folders, look for this file and delete it.

C:\WINDOWS\so_remove.exe


  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Once your system is clean, we suggest that you reverse this to keep critical windows files from accidently being deleted.



Open Hijackthis
  • Go to Misc Tools> Open Uninstall Manager.
  • Click on Save List.
  • The list will open in Notepad.
  • Copy and Paste the List into this thread
Post #20
Ken,
Hope this finds you well. thanks again for all your help. did as suggested. computer seems to be much better from all the tweaking. here is the listing you asked for. I see you are going away for the holiday. have a very Merry Christmas and enjoy the full experience of the day. we will chat upon your return. hope for a joyous new year to you and all near and dear to you.
Rich :D

did not find this file in safe mode

C:\WINDOWS\so_remove.exe



Ad-Aware SE Personal
Adobe Acrobat 4.0
Adobe Download Manager 2.0 (Remove Only)
Adobe Reader 7.0.8
AnalogX TSDropCopy
AOL Instant Messenger
AOL Uninstaller (Choose which Products to Remove)
AVG Anti-Spyware 7.5
AVG Free Edition
BurnQuick
Canon MultiPASS ODBC Interface
Canon MultiPASS Suite 3.21
Canon ScanGear 4.0 for MultiPASS
CCleaner (remove only)
Creative Audio Console
Creative MediaSource
Creative System Information
Digital Camera Manager 3.7
DiMAGE Viewer
DivX
Google Video Player
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 1.99.1
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
hp LaserJet 1000
InterActual Player
InterVideo DVDCopy
InterVideo WinDVD
InterVideo WinDVD 7
J2SE Runtime Environment 5.0 Update 10
Kazaa Lite Resurrection 0.0.8
Macromedia Flash Player 8
Microsoft .NET Framework 2.0
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 SR-1 Professional
Microsoft Windows XP Video Decoder Checkup Utility
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 Parser and SDK
MUSICMATCH® Jukebox
NVIDIA Display Driver
Panda ActiveScan
PowerDVD
RealPlayer
Recover My Files
Reel Deal Casino - Championship Edition
Registry Mechanic 5.2
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB926255)
Sound Blaster Audigy 2 ZS
Spy Sweeper
Spybot - Search & Destroy 1.4
SpywareBlaster v3.5.1
SpywareGuard v2.2
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
USB Dual-mode Camera v200 Installation Files
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Virtual Earth 3D (Beta)
Webshots!
WillMaker 7
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885523
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
ZoneAlarm
Post #21
Hello Rich,

I just saw a few things in the Spysweeper report and wanted to make sure they were not present and I don't see them in your Add-Remove Programs.

But do this…

Make sure that windows is still enabled to show all files and folders, go to C:\Program Files and if any of these folders are present, delete them.

comet cursor
sidesearch
specialoffersnetworks




Download Pocket Killbox to your desktop, unzip it to a folder that you can find

C:\WINDOWS\so_remove.exe


Highlight the file with the complete path inside the Quote Box and press Ctrl C on your keyboard.
  • Open Pocket Killbox
  • Go to File > Paste from clipboard
  • Set it to Delete on Reboot
  • Tick the box that says End Explorer shell while killing file
  • If its not greyed out..Click the radio button that say Unregister .dll before deleting.
  • Make sure Single File is selected
  • Click on the Red circle with the white X
  • It will ask you to confirm the deletion…Say yes
  • It will ask you to reboot, say yes
If you get a message "pending operations has been stopped by external process!" then reboot the computer manually.



Run this quick scan.

Download the Stand Alone Version of CWShredder to your desktop.
  • Open CWShredder
  • Check for Updates
  • Close out the program. <– Dont run it yet

    Boot into Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard

    Open CWShredder
  • Double-click on CWShredder.exe.
  • Click Fix and click OK at the prompt.
  • CWShredder will scan and clean your system of CWS files.
  • Click Next and then Exit .

I will be back online until early tomorrow evening. Someone else will take over if you still need help.

Post a new HJT log and lets make sure nothing has come back.
Post #22
Ken, here is the latest HJT scan…
ran killbox…
nothing found in cwshredder…


Logfile of HijackThis v1.99.1
Scan saved at 6:35:37 PM, on 12/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Canon\MultiPASS\mpservic.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\rich\Desktop\scanner.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adb…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup151.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15027/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: MPService - Canon Information Systems - C:\Program Files\Canon\MultiPASS\mpservic.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


thank you.
MERRY CHRISTMAS AND HAPPY NEW YEAR.
Rich
Post #24
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI