Spyware / Malware / Virus Removal

HijackThis log file

6 min read

Looking for the outcome? Ask AI

rawad Topic Starter

Post #1November 25, 2006, 10:46 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 11:00:22, on 25/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Rawad\LOCALS~1\Temp\Rar$EX00.542\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Global Startup: Supervision de Photo Loader.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{2777749D-836E-499F-AE3B-11FDA92DF88E}: NameServer = 86.64.145.140 84.103.237.140
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett Packard Company - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Susan528

Post #2November 25, 2006, 7:04 PM UTC

Hello rawad and Welcome to TomCoyote,

I really do not see anything wrong with your hijackthis log. What kind of problems are you experiencing?
Let's try a few scans please.

STEP 1.
======
SpySweeper
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

If you are taken to the internet page, just close the page.
You will be prompted to check for updated definitions, please do so.
(This may take several minutes)
Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.
Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!
When the sweep has finished, click Remove. Click Select All and then Next
From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

STEP 2.
======
The AVG anti-spyware program’s detection rate is excellent. After the Trial has expired, the auto updates and real time protection stop but you can still update it manually and run scans anytime you want.

First download AVG anti-spyware 7.5 from HERE and save that file to your
desktop.
This is a 30 day trial of the program

Once you have downloaded AVG anti-spyware , locate the icon on the desktop
and double-click it to launch the set up program.
Once the setup is complete you will need run AVG anti-spyware and update the definition
files.
On the main screen select the icon "Update" then select the "
Update now" link.
- Next select the "Start Update" button, the update will start and a
  progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then
select "Quarantine".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG anti-spyware , Do Not run a scan just yet, we will shortly.

Reboot your computer into SafeMode. You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.

Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while AVG anti-spyware is scanning, it may interfere with the scanning proccess:
Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
AVG anti-spyware will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all
actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
Close AVG anti-spyware and reboot your system back into Normal Mode and post the
results of the AVG anti-spyware report scan.

Please post the results from SpySweeper, AVG anti-spyware and a new hijackthis log.

rawad

Post #3November 26, 2006, 11:20 PM UTC

Hello,
I dont have major security problems, but I think i have someone hacking my internet connection (ADSl) to make phone calls, but i am not sure, because I am getting "Audiotel" telephone calls numbers (08 96 … in france) in my telephone bill that I didn't make, so this is why I posted Hijackthis log.
I just did everything but spy sweeper this afternoon, so i downloaded sweeper and I will attach the log and i will attach this afternoon's logs of the other scans, is this ok ?
second, I have avast anti virus, maybe you know this problem, when i start windows with my ethernet (ADSL) cable on, I have a red dot on avast and i cant start avast nor interent connection for like 2 minutes, and I have the following message fromatt avast: "The AAVM subsystem detected an RPC error.
The operaion could not be completed" (If I plug my ethernet after windows starts, I dont have thisproblem, neither when I use a usb cable.

AVG log:
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 20:20:41 26/11/2006

+ Scan result:

:mozilla.112:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.116:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.117:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.118:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.119:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.203:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.204:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.205:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.206:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.207:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.305:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Walid\Cookies\walid@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.288:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.289:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.290:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.422:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.403:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.404:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.325:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.326:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.327:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.323:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.324:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.268:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.269:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.270:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.10:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.359:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.87:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.331:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.332:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.91:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.
:mozilla.92:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.
:mozilla.93:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.
:mozilla.94:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.
:mozilla.36:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Walid\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned.
:mozilla.121:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Estat : Cleaned.
:mozilla.342:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.208:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.209:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.210:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.211:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.212:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.328:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.124:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.131:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.294:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.295:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.310:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.184:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.185:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.347:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.348:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.349:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.355:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.356:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.357:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.318:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.384:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.186:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.187:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.188:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.189:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.190:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.382:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.108:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.109:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.110:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.111:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.287:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.278:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.279:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.280:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.360:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.361:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Walid\Cookies\walid@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.123:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.125:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.126:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.127:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.366:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.406:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.88:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.89:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.90:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.306:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.395:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.396:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.397:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.398:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.407:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.408:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.409:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.411:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.412:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.414:C:\Documents and Settings\Walid\Application Data\Mozilla\Firefox\Profiles\utdz3qr4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Walid\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.

::Report end

HJT log

Logfile of HijackThis v1.99.1
Scan saved at 20:30:39, on 26/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis1991.exe.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Global Startup: Supervision de Photo Loader.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett Packard Company - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Finally for the spy sweeper, I didn't get "Remove" but "quaratine" so I quarantined it and saved the log, her it is:
00:14: Removal process completed. Elapsed time 00:00:06
00:14: Quarantining All Traces: 2o7.net cookie
00:14: Quarantining All Traces: xiti cookie
00:14: Quarantining All Traces: directtrack cookie
00:14: Quarantining All Traces: bizrate cookie
00:14: Quarantining All Traces: spybuddy
00:14: Removal process initiated
00:11: Traces Found: 20
00:11: Full Sweep has completed. Elapsed time 02:12:54
00:11: File Sweep Complete, Elapsed Time: 02:05:20
00:11: Warning: AntiVirus engine returned [File Corrupted] on [c:\documents and settings\walid\local settings\temporary internet files\content.ie5\uo8cwp6r\the_pink_panther[1].part4.rar]
23:49: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\desktop\movies-sidcom\movie\woody-allen\sco.part4.rar]
23:48: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\wildtangent3.zip]
23:48: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\wildtangent2.zip]
23:48: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\wildtangent1.zip]
23:48: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\wildtangent.zip]
23:48: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\minibug.zip]
23:48: Warning: AntiVirus engine returned [File Corrupted] on [c:\swsetup\msworks\redist\ie6\tempfile.cab]
23:48: Warning: Stream read error
23:45: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\desktop\movies-sidcom\movie\woody-allen\sco.part2.rar]
23:45: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\desktop\movies-sidcom\movie\woody-allen\sco.part6.rar]
23:45: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\desktop\movies-sidcom\movie\woody-allen\sco.part3.rar]
23:45: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\desktop\movies-sidcom\movie\woody-allen\sco.part7.rar]
23:44: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\desktop\movies-sidcom\movie\woody-allen\sco.part1.rar]
23:43: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
23:43: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\hotsearchbar.zip]
23:43: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\microsoftwindowssecurityinternetexplorer.zip]
23:43: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\all users\application data\spybot - search destroy\recovery\hotsearchbar1.zip]
23:39: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\desktop\movies-sidcom\movie\woody-allen\sco.part5.rar]
23:38: Warning: Failed to access drive D:
23:30: Warning: Failed to open file "c:\windows\temp\_avast4_\webshlock.txt". The operation completed successfully
23:23: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\application data\adobe\acrobat\6.0\messages\enu\read0600win_enuadbe0060.pdf]
23:20: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\websearch\websearchenu.pdf]
23:19: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\rawad\application data\adobe\acrobat\6.0\messages\enu\read0600win_enuyhoo0010.pdf]
23:18: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\acrobat\websearch\websearchenu.pdf]
22:59: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\walid\application data\adobe\acrobat\6.0\messages\enu\read0600win_enuadbe0060.pdf]
22:56: Warning: AntiVirus engine returned [Access Denied] on [c:\hiberfil.sys]
22:45: Warning: AntiVirus engine returned [Access Denied] on [c:\pagefile.sys]
22:42: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
22:41: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
22:30: Warning: AntiVirus engine returned [File Corrupted] on [c:\swsetup\dotnet1\dotnetfx.exe]
22:26: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\rdrmsgsplash.pdf]
22:26: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\read0600win_enuyhoo0010.pdf]
22:26: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\rdrmsgenu.pdf]
22:15: Warning: AntiVirus engine returned [File Encrypted] on [c:\documents and settings\walid\application data\adobe\acrobat\6.0\messages\enu\read0600win_enuyhoo0010.pdf]
22:06: C:\Documents and Settings\All Users\Application Data\winsyscfg (14 subtraces) (ID = 2147487027)
22:06: Found System Monitor: spybuddy
22:06: Starting File Sweep
22:06: Cookie Sweep Complete, Elapsed Time: 00:00:03
22:06: c:\documents and settings\rawad\cookies\rawad@msnportal.112.2o7[1].txt (ID = 1958)
22:06: Found Spy Cookie: 2o7.net cookie
22:06: c:\documents and settings\walid\cookies\walid@xiti[1].txt (ID = 3717)
22:06: Found Spy Cookie: xiti cookie
22:06: c:\documents and settings\walid\cookies\[removed][2].txt (ID = 2528)
22:06: c:\documents and settings\walid\cookies\walid@directtrack[1].txt (ID = 2527)
22:06: Found Spy Cookie: directtrack cookie
22:06: c:\documents and settings\walid\cookies\walid@bizrate[2].txt (ID = 2308)
22:06: Found Spy Cookie: bizrate cookie
22:06: Starting Cookie Sweep
22:06: Registry Sweep Complete, Elapsed Time:00:01:16
22:05: Starting Registry Sweep
22:05: Memory Sweep Complete, Elapsed Time: 00:06:01
21:59: Starting Memory Sweep
21:58: Start Full Sweep
21:58: Sweep initiated using definitions version 808
21:58: Spy Sweeper 5.2.3.2125 started
21:58: | Start of Session, dimanche 26 novembre 2006 |
********
21:58: | End of Session, dimanche 26 novembre 2006 |
21:49: Your virus definitions have been updated.
21:48: Informational: Loaded AntiVirus Engine: 2.39.2; SDK Version: 4.11; Virus Definitions: 26/11/2006 08:32:58 (GMT)
21:48: Your spyware definitions have been updated.
Operation: File Access
Target:
Source: C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
21:47: Tamper Detection
21:41: Access to Hosts file allowed for C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
21:35: Shield States
21:35: Spyware Definitions: 790
21:35: Warning: Virus definitions files are invalid, please update your virus definitions. 220
21:33: Spy Sweeper 5.2.3.2125 started
21:33: Spy Sweeper 5.2.3.2125 started
21:33: | Start of Session, dimanche 26 novembre 2006 |
********

Thanks

Susan528

Post #4November 27, 2006, 2:25 PM UTC

I am getting "Audiotel" telephone calls numbers (08 96 … in france) in my telephone bill that I didn't make

Your first hijackthis log contained the following entry:
O17 - HKLM\System\CCS\Services\Tcpip\..\{2777749D-836E-499F-AE3B-11FDA92DF88E}: NameServer = 86.64.145.140 84.103.237.140

When I look up the following IP address, I obtain the following information:
[removed]

Is this related to your Internet Service Provider?

% Information related to '[removed] - [removed]'

inetnum: [removed] - [removed]
netname: FR-LDCOMNET-20050302
org: ORG-LA7-RIPE
descr: LDCOM
country: FR
admin-c: LD699-RIPE
tech-c: LD699-RIPE
status: ALLOCATED PA
remarks: For Hacking, Spamming or Security problems
remarks: send email to *****@gaoland.net
notify: ***@gaoland.net
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: LDCOM-MNT
mnt-lower: LDCOM-OP-MNT
mnt-routes: LDCOM-MNT
mnt-routes: LDCOM-OP-MNT
changed: **********@ripe.net 20050302
changed: *********@ripe.net 20060803
changed: *********@ripe.net 20060803
source: RIPE

organisation: ORG-LA7-RIPE
org-name: LDCOM
org-type: LIR
address: BU Data, Immeuble Quai Ouest
40-42 Quai Du Point Du Jour
address: 92659
address: BOULOGNE-BILLANCOURT
address: France
phone: +33 1 70 18 52 00
fax-no: +33 1 70 18 11 61
e-mail: ***@gaoland.net
admin-c: PG3184-RIPE
admin-c: JP3172-RIPE
admin-c: GJ477-RIPE
mnt-ref: LDCOM-MNT
mnt-ref: RIPE-NCC-HM-MNT
notify: ***@gaoland.net
mnt-by: RIPE-NCC-HM-MNT

rawad

Post #5November 27, 2006, 5:14 PM UTC

the IP adresses are for my ISP provider, but the information do not correspond, because the ISP is called "neuf telecom"or "neuf-cegetel", and I dont see these information in the descrition you gave. Only the "address: BU Data, Immeuble Quai Ouest 40-42 Quai Du Point Du Jour address: 92659 address: BOULOGNE-BILLANCOURT" correspond to the physical address of my ISP "neuf telecom". So what does that means, why do I have "audiotel" telephone number in my bills, even if it is the ISP number, I dont usually pay in my telephone bill the ADSL connection, they 2 seperated companyies, my telephone bill is at the public telephone compagny "France telecom". Do you think someone hacked to call from my place ? Thanks. Tell me if you need a new log or something. N.B: I downloaded ZoneAlarm firewall Maybe the problem is from my friends PC, he uses my ADSL, he connects using USB cable and not a WiFi. We are doing the same procedure that you descibed for me, do you want to post his logs in the same thread, or independently of mine ?

rawad

Post #6November 27, 2006, 7:19 PM UTC

hello, this is the the log files of spy sweeper, HJT, and AVG anti-spyware, of my roomate, that he is using the same connection and the same router that I am. he is using a USB connection, I am using Ethernet, we dont have WIFI:

Logfile of HijackThis v1.99.1
Scan saved at 3:43:45 AM, on 11/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\hgt\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [LoadFUJ02E3] "C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe"
O4 - HKLM\..\Run: [IndicatorUtility] "C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe"
O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] "C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe"
O4 - HKLM\..\Run: [LoadBtnHnd] "C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] "C:\Program Files\ltmoh\Ltmoh.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] "C:\Program Files\Ahead\InCD\InCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Sun clock 4.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161807723500
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://first.groupe-esc-rouen.fr/firstgate…/tsac/msrdp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B2AD638-6D19-4199-A277-7CC132AF8C8F}: NameServer = 86.64.145.140 84.103.237.140
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B2AD638-6D19-4199-A277-7CC132AF8C8F}: NameServer = 86.64.145.140 84.103.237.140
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 6:52:46 PM 11/27/2006

+ Scan result:

:mozilla.247:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.248:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.249:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.250:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.251:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.252:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.253:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.347:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.348:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.349:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.350:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.351:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.352:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.353:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.354:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.355:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.380:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.413:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.496:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.584:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.606:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Cyril Gedeon\Cookies\cyril gedeon@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.232:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.233:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.28:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.225:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.226:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.177:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.178:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.180:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.181:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.182:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.20:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Cyril Gedeon\Cookies\cyril gedeon@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.456:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.109:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.236:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.265:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.266:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.88:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.91:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.92:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.130:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.131:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.132:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.73:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.27:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.96:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Estat : Cleaned.
:mozilla.417:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.273:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.230:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.231:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.173:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.174:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.175:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.382:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.391:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.306:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.307:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.87:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.529:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.530:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.531:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.261:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.158:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.159:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.160:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.161:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.162:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.163:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.200:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.201:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.202:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.203:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.204:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.205:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.206:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.207:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.551:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.167:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.168:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.169:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.170:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.171:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.191:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.192:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.514:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.515:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.524:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.33:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.34:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.35:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.37:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.498:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.89:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.90:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.93:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.107:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.94:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.133:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.134:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.135:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.104:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.262:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.263:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.278:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.78:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.79:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.80:C:\Documents and Settings\Cyril Gedeon\Application Data\Mozilla\Firefox\Profiles\w3y4yuic.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

::Report end

spy sweep

7:38 PM: Removal process completed. Elapsed time 00:00:10
7:38 PM: Quarantining All Traces: atlas dmt cookie
7:38 PM: Removal process initiated
7:36 PM: Traces Found: 1
7:36 PM: Full Sweep has completed. Elapsed time 00:24:32
7:36 PM: File Sweep Complete, Elapsed Time: 00:18:56
7:29 PM: Warning: Failed to open file "c:\windows\temp\_avast4_\webshlock.txt". The operation completed successfully
7:17 PM: Starting File Sweep
7:17 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01
7:17 PM: c:\documents and settings\cyril gedeon\cookies\cyril gedeon@atdmt[1].txt (ID = 2253)
7:17 PM: Found Spy Cookie: atlas dmt cookie
7:17 PM: Starting Cookie Sweep
7:17 PM: Registry Sweep Complete, Elapsed Time:00:00:25
7:17 PM: Starting Registry Sweep
7:17 PM: Memory Sweep Complete, Elapsed Time: 00:05:07
7:12 PM: Starting Memory Sweep
7:12 PM: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
7:11 PM: Start Full Sweep
7:11 PM: Sweep initiated using definitions version 808
7:11 PM: Spy Sweeper 5.2.3.2125 started
7:11 PM: | Start of Session, Monday, November 27, 2006 |
********
7:11 PM: | End of Session, Monday, November 27, 2006 |
Operation: File Access
Target:
Source: C:\WINDOWS\EXPLORER.EXE
7:11 PM: Tamper Detection
7:02 PM: Access to Hosts file allowed for C:\HGT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
6:56 PM: Shield States
6:56 PM: Spyware Definitions: 808
6:56 PM: Warning: Virus definitions files are invalid, please update your virus definitions. 220
6:55 PM: Spy Sweeper 5.2.3.2125 started
Operation: Terminate
Target: C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
Source: C:\WINDOWS\system32\csrss.exe
6:16 PM: Tamper Detection
Operation: Terminate
Target: C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
Source: C:\WINDOWS\system32\csrss.exe
6:16 PM: Tamper Detection
5:52 PM: Access to Hosts file allowed for C:\HGT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
Operation: File Access
Target:
Source: C:\HGT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
5:28 PM: Tamper Detection
4:51 PM: Access to Hosts file allowed for C:\HGT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
4:49 PM: Access to Hosts file allowed for C:\HGT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
4:47 PM: Access to Hosts file allowed for C:\HGT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
11:52 AM: Shield States
11:52 AM: Spyware Definitions: 808
11:52 AM: Warning: Virus definitions files are invalid, please update your virus definitions. 220
11:52 AM: Spy Sweeper 5.2.3.2125 started
3:35 AM: | End of Session, Monday, November 27, 2006 |
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
3:32 AM: Shield States
3:32 AM: Spyware Definitions: 790
3:32 AM: Warning: Virus definitions files are invalid, please update your virus definitions. 220
3:32 AM: Spy Sweeper 5.2.3.2125 started
3:32 AM: Spy Sweeper 5.2.3.2125 started
3:32 AM: | Start of Session, Monday, November 27, 2006 |
********
3:37 AM: | End of Session, Monday, November 27, 2006 |
3:37 AM: Your definitions are up to date.
3:36 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
3:36 AM: None
3:36 AM: Traces Found: 0
3:36 AM: Memory Sweep Complete, Elapsed Time: 00:00:43
3:36 AM: Sweep Canceled
3:35 AM: Starting Memory Sweep
3:35 AM: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
3:35 AM: Start Full Sweep
3:35 AM: Sweep initiated using definitions version 808
3:35 AM: Spy Sweeper 5.2.3.2125 started
3:35 AM: | Start of Session, Monday, November 27, 2006 |
********
4:19 AM: | End of Session, Monday, November 27, 2006 |
4:17 AM: Removal process completed. Elapsed time 00:00:52
4:16 AM: Quarantining All Traces: hotbar/zango
4:16 AM: Quarantining All Traces: 2o7.net cookie
4:16 AM: Quarantining All Traces: mediaplex cookie
4:16 AM: Removal process initiated
4:08 AM: Traces Found: 3
4:08 AM: Full Sweep has completed. Elapsed time 00:26:01
4:08 AM: File Sweep Complete, Elapsed Time: 00:20:32
4:03 AM: Warning: Stream read error
4:03 AM: Warning: Stream read error
4:02 AM: Warning: Failed to access drive F:
4:00 AM: Warning: Failed to open file "c:\windows\temp\_avast4_\webshlock.txt". The operation completed successfully
4:00 AM: Warning: Failed to open file "c:\documents and settings\cyril gedeon\application data\mozilla\firefox\profiles\w3y4yuic.default\parent.lock". The operation completed successfully
3:51 AM: C:\Documents and Settings\Cyril Gedeon\Local Settings\Temp\uz4tbjjf.exe (ID = 280632)
3:51 AM: Found Adware: hotbar/zango
3:48 AM: Starting File Sweep
3:48 AM: Cookie Sweep Complete, Elapsed Time: 00:00:01
3:48 AM: c:\documents and settings\cyril gedeon\cookies\cyril gedeon@msnportal.112.2o7[1].txt (ID = 1958)
3:48 AM: Found Spy Cookie: 2o7.net cookie
3:48 AM: c:\documents and settings\cyril gedeon\cookies\cyril gedeon@mediaplex[1].txt (ID = 6442)
3:48 AM: Found Spy Cookie: mediaplex cookie
3:48 AM: Starting Cookie Sweep
3:48 AM: Registry Sweep Complete, Elapsed Time:00:00:22
3:47 AM: Starting Registry Sweep
3:47 AM: Memory Sweep Complete, Elapsed Time: 00:10:21
3:37 AM: Starting Memory Sweep
3:37 AM: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
3:37 AM: Start Full Sweep
3:37 AM: Sweep initiated using definitions version 808
3:37 AM: Spy Sweeper 5.2.3.2125 started
3:37 AM: | Start of Session, Monday, November 27, 2006 |
********
4:21 AM: None
4:21 AM: Traces Found: 0
4:21 AM: Memory Sweep Complete, Elapsed Time: 00:01:16
4:20 AM: Sweep Canceled
4:20 AM: Starting Memory Sweep
4:19 AM: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
4:19 AM: Start Full Sweep
4:19 AM: Sweep initiated using definitions version 808
4:19 AM: Spy Sweeper 5.2.3.2125 started
4:19 AM: | Start of Session, Monday, November 27, 2006 |
********

Susan528

Post #7November 29, 2006, 6:41 PM UTC last edited November 29, 2006, 6:42 PM UTC

I found this about the Avast error- don't know if this will help or not. I would try posting at their website since it is AVAST specific.

http://www.avast.com/eng/faq-other-questions.html#idt_1539

Q: There´s a red circle on avast! a-ball icon in system tray and when I click on it, the error message appears saying "the AAVM subsystem detected a RPC error". How to fix this?
A: First, use Windows Update to be sure that all Windows components (including "RPC") is up to date. Then restart your computer and check if the problem persists. If it persists, follow these instructions:
1. Right-click the icon MY COMPUTER and select MANAGE.
2. In left column unroll SERVICES AND APPLICATIONS.
3. Click on SERVICES.
4. In the right column, look at the state of service avast! Antivirus.
5. If the service isn't set to start automatically, set it that way (right-click it and select PROPERTIES and the STARTUP TYPE set to AUTOMATIC). Restart the computer after making the change.
6. If it was already set to "Automatic", check the status of the service. If it not "Started", try to start it (right-click it and select START).
7. If the service cannot be started, your avast! installation might be corrupted. Try repairing the avast! installation: click START -> CONTROL PANEL -> ADD/REMOVE PROGRAMS -> avast! Antivirus -> CHANGE/REMOVE and select REPAIR.
This solution works on Windows NT, 2000, XP and 2003 only.

I do not know if someone is hacking and making phone calls or not. I will ask others. How you talked to the phone company?

Susan528

Post #8November 29, 2006, 6:54 PM UTC

Do you have a firewall application installed or are you relying just on the Windows XP firewall? Is the AVAST just anti-virus or does it include a firewall?

No Firewall Onboard

You don't seem to have a firewall program installed. Please do not rely solely on the Windows XP firewall. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:

Test your Firewall - Please test your firewall and make sure it is working properly.
Test Firewall

Susan528

Post #9November 29, 2006, 8:10 PM UTC

Please do the following scans:

STEP 1.
======
Combofix

Download this file - combofix.exe
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

STARTDRECK

Download StartDreck

Unzip to its own folder and start the program:
Press 'Config'
Press 'Unmark All'

Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes
Press 'Ok'

Press 'Save' and select the location to save the log file (default is the same folder as the application)

Post (reply) with the ComboFix log, the StartDreck log, and a new hijackthis log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

HijackThis log file

✨ Ask AI

Ask AI