What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help in Removal of Spyware/Trojan Alert

38 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #47
Dear Little Eagle,

It has freed some space…Here is the HJT log

Logfile of HijackThis v1.99.1
Scan saved at 6:14:09 AM, on 12/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Common Files\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Lotus7\notes\ntmulti.exe
C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tcs.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://r.office.microsoft.com/r/rlidOutlookWelcomeMail3
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\ThinkVantage Fingerprint Software\ctlcntr.exe" /startup
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VideoraiPodConverter] C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe -t
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [NetSP - restore settings on power failure] "C:\Program Files\AT&T Global Network Client\NetSP.exe" -show
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: psfus - C:\Program Files\ThinkVantage Fingerprint Software\psfus.dll
O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Lotus7\notes\ntmulti.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe

+++++++++++++++++++++++++++++
Also attached is the Spyware Doctor log
+++++++++++++++++++++++++++++
Scan Results:
scan start: 11/30/2006 8:06:27 PM
scan stop: 11/30/2006 8:15:34 PM
scanned items: 100246
found items: 17
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner



Infection Name Location Risk
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\4FZ3M4X9\10285205-42[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\4FZ3M4X9\10397306-17[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\5JZTNXZK\13702_10000002[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\5JZTNXZK\show[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\67A7U9Q3\show[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\10379812-29[1].gif High
Advertising C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\imgcr_E13_C19237-1[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\AHCPKXYH\1335_10000270[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\88000000000029307[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\10306368-14[1].jpg High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\2202737-44[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10399221-2[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\show[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\1335_10001355[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\9785835-24[1].gif High
Advertising C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\imgcr_E13_C19237-2[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\show[1].gif High

Scan Results:
scan start: 11/30/2006 9:37:24 PM
scan stop: 11/30/2006 9:46:02 PM
scanned items: 94875
found items: 17
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner



Infection Name Location Risk
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\4FZ3M4X9\10285205-42[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\4FZ3M4X9\10397306-17[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\5JZTNXZK\13702_10000002[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\5JZTNXZK\show[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\67A7U9Q3\show[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\10379812-29[1].gif Low
Advertising C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\imgcr_E13_C19237-1[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\AHCPKXYH\1335_10000270[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\88000000000029307[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\10306368-14[1].jpg Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\2202737-44[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10399221-2[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\show[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\1335_10001355[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\9785835-24[1].gif Low
Advertising C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\imgcr_E13_C19237-2[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\show[1].gif Low

Scan Results:
scan start: 12/1/2006 6:15:12 AM
scan stop: 12/1/2006 6:15:13 AM
scanned items: 1
found items: 0
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner



Infection Name Location Risk

Scan Results:
scan start: 12/1/2006 6:15:40 AM
scan stop: 12/1/2006 6:23:39 AM
scanned items: 92987
found items: 0
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner



Infection Name Location Risk

Please help.
Post #48
Reboot in safe mode, instructions here.
Some of these files my have hidden atributes.
Click Here Should you need instructions for Showing hidden files and folders in Windows.
Once in safe mode, Click start / then my computer / local disk then follow the process tree.

C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\

Then delete everything in the folder.
Post #49
Dear Little Eagle, I tried but seems its still there..Here is the Spyware Doctor log. Pls help. Thanks Vinod =========================== Scan Results: scan start: 12/1/2006 6:16:01 PM scan stop: 12/1/2006 6:28:15 PM scanned items: 89905 found items: 2 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\[removed][1].txt Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png ===========================
Post #51
Dear Little Eagle,

Please find the log of Spyware Doctor :

Scan Results:
scan start: 12/1/2006 10:29:29 PM
scan stop: 12/1/2006 10:37:31 PM
scanned items: 92703
found items: 7
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner

Infection Name Location Risk
Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\[removed][1].txt Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\13812_10000013[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\2202737-44[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10379804-31[1].gif High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10306368-14[1].jpg High
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10399374-16[1].gif High

Scan Results:
scan start: 12/1/2006 10:47:18 PM
scan stop: 12/1/2006 10:55:53 PM
scanned items: 92810
found items: 7
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner

Infection Name Location Risk
Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\[removed][1].txt Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\13812_10000013[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\2202737-44[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10379804-31[1].gif Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10306368-14[1].jpg Low
Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10399374-16[1].gif Low

==================================================================

Logfile of HijackThis v1.99.1
Scan saved at 10:59:14 PM, on 12/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Common Files\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Lotus7\notes\ntmulti.exe
C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tcs.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://r.office.microsoft.com/r/rlidOutlookWelcomeMail3
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\ThinkVantage Fingerprint Software\ctlcntr.exe" /startup
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VideoraiPodConverter] C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe -t
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [NetSP - restore settings on power failure] "C:\Program Files\AT&T Global Network Client\NetSP.exe" -show
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: psfus - C:\Program Files\ThinkVantage Fingerprint Software\psfus.dll
O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Lotus7\notes\ntmulti.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe

==================================================================

Regards
Vinod
Post #52 last edited

Please find the log of Spyware Doctor :

Scan Results:
scan start: 12/1/2006 10:29:29 PM
scan stop: 12/1/2006 10:37:31 PM
scanned items: 92703
found items: 7
found and ignored: 0

Doesn't spyware doctor delete them :unsure:

There is nothing wrong there in the log.
Post #53
Dear Little Eagle, Unfortunately, I didn't buy the Registered software from Spyware so not able to delete the files. Here is the fresh log..Pls advise..How to remove 'Known Bad Sites' ============================================================== Scan Results: scan start: 12/2/2006 1:11:27 AM scan stop: 12/2/2006 1:20:36 AM scanned items: 93759 found items: 6 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\13812_10000013[1].gif High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\2202737-44[1].gif High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10379804-31[1].gif High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10306368-14[1].jpg High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10399374-16[1].gif High ============================================================== Rgds Vinod
Post #54
Dear Little Eagle, Pls find the log of Spyware Doctor attached. Though the risk is low but everytime I browse it comes up. =============================================================== Scan Results: scan start: 12/2/2006 1:11:27 AM scan stop: 12/2/2006 1:20:36 AM scanned items: 93759 found items: 6 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\13812_10000013[1].gif High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\2202737-44[1].gif High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10379804-31[1].gif High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10306368-14[1].jpg High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10399374-16[1].gif High Scan Results: scan start: 12/2/2006 1:27:39 AM scan stop: 12/2/2006 1:37:14 AM scanned items: 94280 found items: 8 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\13812_10000013[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\logo1[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\movie1[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\2202737-44[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10379804-31[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10306368-14[1].jpg Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10399374-16[1].gif Low Scan Results: scan start: 12/2/2006 1:40:16 AM scan stop: 12/2/2006 1:49:24 AM scanned items: 94905 found items: 12 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\10376988-4[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\movie1[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\A9F4LWB6\logop1[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\13812_10000013[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\logo1[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\movie1[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\2202737-44[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\logop2[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10379804-31[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10306368-14[1].jpg Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10399374-16[1].gif Low Scan Results: scan start: 12/2/2006 8:34:52 AM scan stop: 12/2/2006 8:44:33 AM scanned items: 97895 found items: 20 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\10376988-4[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\movie1[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\A9F4LWB6\1335_10000270[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\A9F4LWB6\logop1[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\1335_10001477[1].jpg Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\13812_10000013[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\logo1[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\movie1[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\show[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\2202737-44[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\10300835-12[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\8784186-32[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\88000000000030084[1].jpg Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\logop2[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10379804-31[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10306368-14[1].jpg Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10392978-37[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10399374-16[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\9785835-24[1].gif Low Scan Results: scan start: 12/2/2006 8:56:59 AM scan stop: 12/2/2006 9:07:05 AM scanned items: 98296 found items: 21 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\10376988-4[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\8FAN0PWL\movie1[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\A9F4LWB6\1335_10000270[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\A9F4LWB6\logop1[1].gif Low Fast Video Player Dialer C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\AHCPKXYH\vendor_redir[1].htm High Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\1335_10001477[1].jpg Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\13812_10000013[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\logo1[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\movie1[1].htm Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\FRH3BTWW\show[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\2202737-44[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\G4UZECST\newmoon11[1].png Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\10300835-12[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\8784186-32[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\88000000000030084[1].jpg Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\O1QF4TI1\logop2[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\REHVX9GE\10379804-31[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10306368-14[1].jpg Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10392978-37[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\TBBOI4L3\10399374-16[1].gif Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\UF89UTY9\9785835-24[1].gif Low =================================================================== Rgds Vinod
Post #56
Dear Little Eagle,

I guess there is a background Spyware i guess…'Known Bad Sites'

++++++++++++++++++++++++++++++++++++++++++++++++++++

Logfile of HijackThis v1.99.1
Scan saved at 9:41:20 AM, on 12/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Common Files\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Lotus7\notes\ntmulti.exe
C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Lotus\Sametime Client\Connect.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tcs.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://r.office.microsoft.com/r/rlidOutlookWelcomeMail3
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\ThinkVantage Fingerprint Software\ctlcntr.exe" /startup
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VideoraiPodConverter] C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe -t
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [NetSP - restore settings on power failure] "C:\Program Files\AT&T Global Network Client\NetSP.exe" -show
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: psfus - C:\Program Files\ThinkVantage Fingerprint Software\psfus.dll
O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Lotus7\notes\ntmulti.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe

++++++++++++++++++++++++++++++++++++++++++++++++++++

Regards
Vinod
Post #57
Dear Little Eagle,

There are some more virus in my machine..

Logfile of HijackThis v1.99.1
Scan saved at 2:15:27 AM, on 12/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Common Files\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Lotus7\notes\ntmulti.exe
C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tcs.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://r.office.microsoft.com/r/rlidOutlookWelcomeMail3
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\ThinkVantage Fingerprint Software\ctlcntr.exe" /startup
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VideoraiPodConverter] C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe -t
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [NetSP - restore settings on power failure] "C:\Program Files\AT&T Global Network Client\NetSP.exe" -show
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: psfus - C:\Program Files\ThinkVantage Fingerprint Software\psfus.dll
O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Lotus7\notes\ntmulti.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe

Please help.

Thanks
Vinod
Post #58
Dear Little Eagle, I still have the Tracking Cookie(s),Advertising and Known Bad Sites. Though its error is Low would appreciate if you can help in this. Regards Vinod Scan Results: scan start: 12/5/2006 9:39:17 PM scan stop: 12/5/2006 9:46:24 PM scanned items: 90609 found items: 18 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\tcs@2o7[2].txt Low Advertising C:\Documents and Settings\TCS\Cookies\[removed][1].txt Low Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\tcs@adrevolver[2].txt Low Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\tcs@adrevolver[3].txt Low Advertising C:\Documents and Settings\TCS\Cookies\[removed][2].txt Low Advertising C:\Documents and Settings\TCS\Cookies\tcs@advertising[1].txt Low Advertising C:\Documents and Settings\TCS\Cookies\tcs@casalemedia[1].txt Low Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\[removed][1].txt Low Advertising C:\Documents and Settings\TCS\Cookies\tcs@doubleclick[2].txt Low Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\tcs@edge.ru4[1].txt Low Advertising C:\Documents and Settings\TCS\Cookies\tcs@fastclick[2].txt Low Advertising C:\Documents and Settings\TCS\Cookies\tcs@mediaplex[1].txt Low Advertising C:\Documents and Settings\TCS\Cookies\tcs@overture[1].txt Low Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\tcs@questionmarket[1].txt Low Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\tcs@serving-sys[1].txt Low Advertising C:\Documents and Settings\TCS\Cookies\tcs@statcounter[2].txt Low Tracking Cookie(s) C:\Documents and Settings\TCS\Cookies\tcs@tribalfusion[1].txt Low Known Bad Sites C:\Documents and Settings\TCS\Local Settings\Temporary Internet Files\Content.IE5\A507ER45\6652[1].gif Low
Post #59
You will get these as long as you are on the internet.

There is nothing you can do about them :)

Download and run - ATF Cleaner instructions here.
How ever if you open IE you will get more when you go to a web site.

To help keep your PC clean follow the recommendations here by shelf life.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI