What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

x password

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My daughter is have problems with her computer, here is her HJT log: Thanks in advance for your help!


Logfile of HijackThis v1.99.1
Scan saved at 9:54:21 PM, on 12/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\X Password Manager\isamonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\MCROSO~1\userinit.exe
C:\Program Files\S?mantec\services.exe
C:\Program Files\X Password Manager\isamini.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R3 - URLSearchHook: (no name) - {60188BFB-174B-12C1-3806-3F31C0B2FA9D} - C:\WINDOWS\system32\eozso.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\X Password Manager\isaddon.dll
O2 - BHO: (no name) - {60188BFB-174B-12C1-3806-3F31C0B2FA9D} - C:\WINDOWS\system32\eozso.dll
O3 - Toolbar: Protection Bar - {a2595f37-48d0-46a1-9b51-478591a97764} - C:\Program Files\X Password Manager\iesplugin.dll
O3 - Toolbar: OIN Search - {B9F6E8EB-A4E3-478E-88A4-D3995B5C45C8} - C:\Program Files\OIN Search\OINSearch.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [Tbsa] "C:\WINDOWS\system32\MCROSO~1\userinit.exe" -vt yazb
O4 - HKCU\..\Run: [Stj] C:\Program Files\S?mantec\services.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=laptop
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: bestreak - {874443fe-aa33-4ebf-a6ac-73208787e62d} - C:\WINDOWS\system32\viruxz.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\cnlhbjAx\command.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
Post #2
Hi poporacer. I need to take some time to look over your Hijack This log to come up with a fix. Please remember that I am an undergraduate which means I need to have my posts to you checked by a teacher or moderator to make sure I'm giving you the proper instructions. This process won't take long and I thank you for your patience. I'll be back with you soon.
Post #3
Some real nasties in there poporacer. First I would like you to generate an uninstall list with Hijack This, instructions below:
  • Run Hijackthis.
  • Click on Open the Misc Tools section.
  • Next click on Open uninstall manager.
  • Press the Save list button. It will open a Notepad file.
  • Save the file to your desktop, with the default name of uninstall_list
  • Copy & Paste the entire contents of that file in your in your next post.
Next follow these instructions:

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd

[external image: Posted Image]

Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with the uninstall list in your next reply.

IMPORTANT: Do NOT run any other options until you are asked to do so!
Post #4
Thanks for your help! Here are the files:
StartupList report, 12/10/2006, 8:31:37 PM
StartupList version: 1.52.2
Started from : C:\HJT\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\X Password Manager\isamonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\MCROSO~1\userinit.exe
C:\Program Files\X Password Manager\isamini.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\S?mantec\services.exe
C:\HJT\HijackThis.exe

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

(Default) =

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Tbsa = "C:\WINDOWS\system32\MCROSO~1\userinit.exe" -vt yazb
Stj = C:\Program Files\S?mantec\services.exe

————————————————–

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\sstext3d.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

————————————————–

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

————————————————–

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\X Password Manager\isaddon.dll - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}
(no name) - C:\WINDOWS\system32\rpe.dll - {800C58B8-935A-CDDD-7A42-EBECDD934F9C}

————————————————–

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx
CODEBASE = http://fpdownload.macromedia.com/get/flash…ent/swflash.cab

————————————————–

Enumerating Windows NT/2000/XP services

Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Command Service: C:\WINDOWS\cnlhbjAx\command.exe (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
ewido anti-spyware 4.0 guard: C:\Program Files\ewido anti-spyware 4.0\guard.exe (autostart)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
LexBce Server: C:\WINDOWS\system32\LEXBCES.EXE (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
AEGIS Protocol (IEEE 802.1x) v2.3.1.9: system32\DRIVERS\mdc8021x.sys (autostart)
mdmxsdk: system32\DRIVERS\mdmxsdk.sys (autostart)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)


————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
bestreak: C:\WINDOWS\system32\viruxz.dll

————————————————–
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

homepage.monitor.exe = C:\Program Files\X Password Manager\isamonitor.exe
pmsngr.exe = C:\Program Files\X Password Manager\pmsngr.exe

————————————————–

End of report, 9,653 bytes
Report generated in 0.110 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

SmitFraudFix v2.70

Scan done at 20:33:49.73, Sun 12/10/2006
Run from C:\Documents and Settings\ryan01\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\ryan01\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ryan01\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"bestreak"="{874443fe-aa33-4ebf-a6ac-73208787e62d}"


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End
Post #5
Nice poporacer, but the startup list is not what I wanted. I wanted an uninstall list, but it's OK that you posted a startup list. Please go back to my previous post and post the uninstall list next time. In the meantime also follow the instructions below:

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.

[external image: Posted Image]

Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

Along with the above log please post the uninstall list from Hijack This. Could you also let me know if your installation of Ewido Anti-Spyware is up to date and if it was purchased or is still the trial version? We may need to uninstall it and install the newer version.
Post #6
Sorry about that. The Ewido program she has is the trial version ver 4.0.0.0.172. Here are the logs: 2Wire Wireless Client ABBYY FineReader 5.0 Sprint Plus Absolute Poker Basic Adobe Photoshop Album 2.0 Starter Edition Adobe Reader 6.0.1 CCHelp CCScore Conexant AC-Link Audio ESSAdpt ESSANUP ESSCAM ESSCDBK ESScore ESSgui ESShelp ESSini ESSPCD ESSSONIC ESSvpaht ESSvpot ewido anti-spyware 4.0 HijackThis 1.99.1 HLPIndex HLPRFO HP Deskjet Preloaded Printer Drivers HP Software Update Identity Theft Protector Intel® Extreme Graphics 2 Driver Internet Explorer Security Plugin 2006 Internet Security Add-On InterVideo WinDVD J2SE Runtime Environment 5.0 Update 2 Java 2 Runtime Environment, SE v1.4.2_03 Kodak EasyShare software KSU Lawn Care Calculator Lawn Care Letter Writer LawnPro Lexmark 5200 Series Lexmark Fax Solutions Lexmark Photo Center Lexmark Z700-P700 Series Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB886903) Mozilla Firefox (1.5.0.8) MSN MSXML 4.0 SP2 (KB927978) Notifier OIN Search OTtBP OTtBPSDK Outerinfo PCDADDIN PCDHELP PCDLNCH Photosmart 140,240,7200,7600,7700,7900 Series Public Messenger ver 2.03 Quick Launch Buttons 5.00 B3 QuickTime RecordNow! SBC Yahoo! Applications Scrapbook Factory Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB925486) SFR SFR2 SoftV92 Data Fax Modem with SmartCP Sonic Update Manager Synaptics Pointing Device Driver Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Viewpoint Media Player VPRINTOL Windows Installer 3.1 (KB893803) Windows Installer 3.1 (KB893803) Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 Yahoo! Install Manager Yahoo! Photos Easy Upload Tool 1v4 Zone Deluxe Games SmitFraudFix v2.70 Scan done at 22:46:41.16, Mon 12/11/2006 Run from C:\Documents and Settings\ryan01\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "bestreak"="{874443fe-aa33-4ebf-a6ac-73208787e62d}" »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri C:\WINDOWS\system32\viruxz.dll -> Missing File »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "bestreak"="{874443fe-aa33-4ebf-a6ac-73208787e62d}" »»»»»»»»»»»»»»»»»»»»»»»» End
Post #7
No problem poporacer. Please follow the steps below:

Step 1

Click Start—>Run. In the run box type appwiz.cpl and press enter. In the list that appears please highlight (one at a time) the following programs and click remove:

ewido anti-spyware 4.0
OIN Search
Outerinfo

I notice you also have Absolute Poker and Zone Deluxe Games installed. If you don't use those programs I would recommend uninstalling them as well.

Step 2

Download ATF cleaner from here.

Locate ATF Cleaner.exe and open it.

Under Main select the following:

Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Step 3

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update AVG.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
______________________________

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
______________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      [external image: Posted Image]
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
______________________________

Please post:
  • AVG log
  • A new HijackThis log
Post #8
Thanks…here it is. Logfile of HijackThis v1.99.1 Scan saved at 9:42:34 PM, on 12/13/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\HJT\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=laptop O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: bestreak - {874443fe-aa33-4ebf-a6ac-73208787e62d} - (no file) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\cnlhbjAx\command.exe (file missing) O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 9:33:15 PM 12/13/2006 + Scan result: C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029579.exe -> Adware.180Solutions : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP420\A0031580.exe -> Adware.ClickSpring : Cleaned with backup (quarantined). C:\Program Files\X Password Manager -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\X Password Manager\iesplugin.dll -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\X Password Manager\iesuninst.exe -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\X Password Manager\isaddon.dll -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\X Password Manager\isauninst.exe -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\X Password Manager\ot.ico -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\X Password Manager\pmmon.exe -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\X Password Manager\pmuninst.exe -> Adware.Generic : Cleaned with backup (quarantined). C:\Program Files\X Password Manager\ts.ico -> Adware.Generic : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\CLSID\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} -> Adware.Generic : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\CLSID\{874443fe-aa33-4ebf-a6ac-73208787e62d} -> Adware.Generic : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\CLSID\{a2595f37-48d0-46a1-9b51-478591a97764} -> Adware.Generic : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{a2595f37-48d0-46a1-9b51-478591a97764} -> Adware.Generic : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} -> Adware.Generic : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On -> Adware.Generic : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 -> Adware.IntCodec : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 -> Adware.IntCodec : Cleaned with backup (quarantined). C:\WINDOWS\system32\P2P Networking v126.cpl -> Adware.P2PNet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP410\A0029667.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP410\A0029668.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029712.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029713.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029751.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029752.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0030391.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0030412.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031425.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031442.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP420\A0031574.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP412\A0030213.dll -> Adware.Solution : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029066.dll -> Adware.Zango : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029293.dll -> Adware.Zango : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029586.dll -> Adware.Zango : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0030392.exe -> Downloader.Purit.co : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0030413.exe -> Downloader.Purit.co : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP420\A0031579.exe -> Downloader.PurityScan.dm : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029582.manifest -> Downloader.Zlob : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP401\A0029040.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP401\A0029047.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029055.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029062.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029073.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029081.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029089.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029099.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029107.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029115.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029123.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029131.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP405\A0029139.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP405\A0029148.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP406\A0029191.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP406\A0029201.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP406\A0029209.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP406\A0029217.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029300.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029308.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029316.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029324.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029343.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029351.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029361.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029374.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029575.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029590.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029597.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029604.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029614.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029623.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029632.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029644.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029653.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP410\A0029662.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029705.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029719.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029728.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029737.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029746.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029760.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029769.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029778.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029788.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029797.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029806.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP412\A0030219.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP412\A0030236.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP413\A0030244.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP413\A0030251.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP417\A0030388.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0030399.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0030410.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031410.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031417.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031423.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031434.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031440.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031462.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031474.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP420\A0031478.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP420\A0031584.dll -> Downloader.Zlob.adj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP401\A0029041.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP401\A0029048.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029056.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029063.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029074.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029083.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP402\A0029090.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029101.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029108.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029116.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029124.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP404\A0029132.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP405\A0029140.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP405\A0029149.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP406\A0029192.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP406\A0029202.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP406\A0029210.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP406\A0029218.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029301.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029309.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029318.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029325.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029344.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029353.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP408\A0029362.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029375.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029576.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029591.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029598.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029606.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029615.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029625.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029633.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029645.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029654.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP410\A0029663.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029706.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029720.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029729.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029738.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029747.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029761.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029770.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029779.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029789.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029798.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029807.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP412\A0030220.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP412\A0030237.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP413\A0030245.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP413\A0030252.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP417\A0030369.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP417\A0030380.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP420\A0031586.exe -> Downloader.Zlob.adl : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP409\A0029580.exe -> Downloader.Zlob.yr : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP420\A0031576.exe -> Dropper.Small : Cleaned with backup (quarantined). C:\Documents and Settings\ryan01\Local Settings\Temporary Internet Files\Content.IE5\XT97UW1N\installdrivecleanerstart[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.m : Cleaned with backup (quarantined). :mozilla.103:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.28:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.29:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.30:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.31:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.32:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.33:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.34:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.35:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.36:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.38:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.39:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.447:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.448:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.449:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.450:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.451:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.452:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.453:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.454:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.552:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.553:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned. :mozilla.376:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.377:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.413:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.516:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.517:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.286:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.287:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.545:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Adserver : Cleaned. :mozilla.107:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.108:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.109:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.110:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.111:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.59:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.298:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Bfast : Cleaned. :mozilla.180:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.181:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.58:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.176:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.252:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.336:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.338:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.292:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.293:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.294:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.346:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned. :mozilla.69:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.70:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.121:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.123:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.127:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.302:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.122:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.124:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.125:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.126:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.71:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.72:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.73:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.315:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.316:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.317:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.318:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.319:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.320:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.321:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.322:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.74:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.75:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.76:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.275:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.276:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.277:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.278:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.279:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.189:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.190:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.191:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.192:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.193:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.194:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.195:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.196:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.197:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.198:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.199:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.200:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.201:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.202:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.203:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.204:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.262:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned. :mozilla.263:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned. :mozilla.264:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned. :mozilla.265:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned. :mozilla.266:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned. :mozilla.470:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.251:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.144:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.145:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.493:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned. :mozilla.404:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.405:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.154:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.335:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.114:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.90:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.91:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.92:C:\Documents and Settings\ryan01\Application Data\Mozilla\Firefox\Profiles\4ufp2nuo.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP410\A0029669.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029714.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP411\A0029753.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0030393.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0030414.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031427.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP419\A0031444.exe -> Trojan.Small : Cleaned with backup (quarantined). C:\WINDOWS\cnlhbjAx\BESfMBP0WgHksKLOBocKu2iwip.vbs -> Trojan.Small : Cleaned with backup (quarantined). C:\WINDOWS\system32\wnsintsv.exe -> Trojan.Small : Cleaned with backup (quarantined). ::Report end
Post #9
Nice job poporacer. Log looks much better. Just a couple more things.

Step 1

Please download delcmdservice (by Marckie), and save it to your Desktop.
  • Unzip the content to your Desktop (a folder named delcmdservice)
  • Double-click on the delcmdservice folder
  • Double-click on delreg.bat to launch the tool
  • When the tool has finished, please reboot your computer.
Step 2

Please run Hijack This again and have it do a system scan only. Put a check (tick) next to the following entries (don't worry if some don't exist):

O21 - SSODL: bestreak - {874443fe-aa33-4ebf-a6ac-73208787e62d} - (no file)

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\cnlhbjAx\command.exe (file missing)

Close all other browsers/windows and click Fix Checked. Close Hijack This. Reboot the PC.

Step 3

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version…

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 5.0 Update 9.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement."
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-1_5_0_09-windowsi586-p.exe to install the newest version.
After that please post a fresh Hijack This log for a final check.
Post #10
OK… here it is! Logfile of HijackThis v1.99.1 Scan saved at 11:41:02 PM, on 12/14/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre1.6.0\bin\jusched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\HJT\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0\bin\jusched.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=laptop O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
Post #11
Couldn't look better poporacer. Great Job!
:)

Please read below for some suggestions on staying clean.

Congratulations. Your log is clean! You should reward yourself very liberally! Now some pointers on how to stay clean and keep your sanity. You may be thinking now "how did I get infected?" Please read this great article: So how did I get infected in the first place.

Next follow the instructions below to keep yourself free from infection.

Disable and then enable system restore to purge infected restore points.

Turn OFF System Restore.
  • On the Desktop, right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore.
  • Click Apply.
  • Click OK.
To enable system restore:
  • Uncheck the box by Turn off system restore
  • Click Apply.
  • System restore is now on.
  • Create a restore point by clicking Start—>All programs—>Accessories—>System tools—>System restore
  • Select the bubble that says Create restore point. Then click Next.
  • Give the restore point a meaningful name like post malware removal. Then click OK.
Rehide hidden files and folders. During your fix if you were asked to "show hidden files and folders" you should go back now and re-hide them. You wouldn't want to accidentally delete important files. Follow the instructions below:
  • Click "Start".
  • Click "My Computer".
  • Select the "Tools" menu and click "Folder Options".
  • Select the "View" tab.
  • Under the "Hidden files and folders" heading, select "Do not show hidden files and folders".
  • Check the "Hide protected operating system files (recommended)" option.
  • Check the "Hide file extensions for known file types".
  • Click Apply then click "OK".

Update with SP2 if you don't aleady have it.
Visit Windows Update and follow the onscreen instructions to download and install SP2.
This is a time consuming process, even with a fast connection. If you use a dial-up connection you should consider getting a FREE copy
directly from Microsoft or get a friend with a fast connection to burn a copy of the upgrade to CD for you.

Update the OS regularly

Set up system to ensure a regular update of the Operating System.

Manually:

Visit Windows Update on a weekly/biweekly REGULAR basis.

Automatically:
  • On the Desktop, right-click My Computer.
  • Click Properties.
  • Click on Automatic Updates.
  • Check the option of choice (I use Automatic (Recommended)). If you use dial-up I would recommend using the
    Notify Me option so that you can download when you can afford the time and bandwidth overheads.
  • Select the Day/Time of choice
  • Click Apply
  • Click OK

Secure your web browser
  • Open Internet Explorer and click on the Tools menu and then click on
    Security
  • Click the Internet icon
  • Click onCustom Level.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • Change the Allow paste operations via script to Disable
  • Click on OK
  • Save (if asked).
  • Click on Applybutton
  • Click on OK
Alternatively you could use another browser such as
Mozilla Firefox (My personal favorite!)
Opera

Get Some Protection
The following programs are useful in the fight against Malware. Best of all, they're FREE.
Download and install any or all . Be warned though —- You must update regularly. Check once a week!
  • Ad-Aware SE - This is a
    program that scans for and removes known spyware from your machine.
  • Spybot Search &
    Destroy     -Similar to Ad-Aware but more configurable and incorporates Teatime, a memory resident utility that protects the system registry.
  • Spyware Blaster -
    It Prevents the addition of ActiveX Controls on your machines by
    isolating the system registry (Highly Recommended).
A good Antiviral program is essential. The ones listed below are free. Please download and use ONE of these if you're not already running an Antivirus program:
And Finally………Lock the door with a Firewall. Windows XP comes with its own simple firewall but I prefer to substitute it with one of the below, again these are free: I wish you very happy, and most importantly, safe surfing on the information superhighway. Just remember it can be dangerous.
Post #14
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI