Spyware / Malware / Virus Removal

Trojan horse Lop.AS

19 min read

Looking for the outcome? Ask AI

St.Thanos Topic Starter

Post #1January 18, 2007, 10:37 AM UTC last edited January 18, 2007, 10:41 AM UTC

My AVG scanner will pick this up, whether i heal it or move it to the vault it returns a couple minutes later.
the file is located in my temporary internet files\contentIE.5 folders, the file is named "lo1(1).dll" or "lo1(2).dll"
when i look the file up in the temp internet files folder it also has an ip # attached to it

here is my hjt logfile

Logfile of HijackThis v1.99.1
Scan saved at 5:35:14 AM, on 1/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\The Cleaner\tcm.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\The Cleaner\tca.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\PATCH\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.buffalowildwings.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 222.45.36.8:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ams-server*
O2 - BHO: (no name) - {71B45E0D-2FD2-4EA6-91FD-A0AFEB696BD0} - C:\WINDOWS\system32\awtutur.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Save to &Xdrive - res://C:\Program Files\Xdrive\Xdrive Desktop\xdrive.exe/std.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - http://help.rr.com/Foundrysdccommon/download/tgctlar.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/…svc32_EN_XP.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF42EB50-B9C5-46EA-B09E-5CF0C5AF0BAA}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: awtutur - C:\WINDOWS\SYSTEM32\awtutur.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winjne32 - winjne32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

IndiGenus

Post #2January 18, 2007, 11:23 PM UTC

Hi St. Thanos and welcome to the forums here at Tom Coyote.

You do appear to have a Vundo infection. But before doing anything please move HJT as instructed so we will have backups available if needed:
You are running HijackThis from the desktop. I recommend that you move HJT to it's own permanent folder.
Please do the following:Create a new permanent folder in a convenient location that you will remember. To do this: Open Windows Explorer.
Select the drive or folder that you would like to put HJT
From the menu select File > New > Folder
Rename the folder to something you will remember (ie HJT, HijackThis, ect…)
Now move HJT to the new folder that you created.
Do not make any changes or click Fix checked until we check the log, as many of the files are legit and vital to your computers' health.

Now we can deal with Vundo.
Please download
VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click Yes
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from Click the Scan for Vundo button when VundoFix appears at reboot.

Regards,
Dave

St.Thanos

Post #3January 19, 2007, 6:06 AM UTC

Thank you Dave. I appreciate the help.

here is the vundofix.txt

VundoFix V6.3.2

Checking Java version…

Java version is 1.5.0.6

Java version is 1.5.0.9

Scan started at 12:32:47 AM 1/19/2007

Listing files found while scanning….

C:\WINDOWS\SYSTEM32\awtutur.dll

Beginning removal…

Attempting to delete C:\WINDOWS\SYSTEM32\awtutur.dll
C:\WINDOWS\SYSTEM32\awtutur.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.2

Checking Java version…

Java version is 1.5.0.6

Java version is 1.5.0.9

Scan started at 1:00:35 AM 1/19/2007

Listing files found while scanning….

and here is the new highjackthis log

Logfile of HijackThis v1.99.1
Scan saved at 1:05:27 AM, on 1/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\The Cleaner\tcm.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\The Cleaner\tca.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Documents and Settings\PATCH\Desktop\VundoFix.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\PATCH\My Documents\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.buffalowildwings.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 222.45.36.8:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ams-server*
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Save to &Xdrive - res://C:\Program Files\Xdrive\Xdrive Desktop\xdrive.exe/std.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - http://help.rr.com/Foundrysdccommon/download/tgctlar.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/…svc32_EN_XP.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF42EB50-B9C5-46EA-B09E-5CF0C5AF0BAA}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winjne32 - winjne32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

IndiGenus

Post #4January 19, 2007, 3:51 PM UTC

OK so far, so good.

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O20 - Winlogon Notify: winjne32 - winjne32.dll (file missing)

Then close all windows except this one and press Fix checked.

Use ATF Cleaner to remove temp files, cookies, cache, ect…

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main select the following:
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Using Internet Explorer, click on Kaspersky Online Scanner * You will be prompted to install an ActiveX component from Kaspersky, Click 'Yes'.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save as Text' button:
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log.

Also let me know how things are running at this point.

Dave

St.Thanos

Post #5January 19, 2007, 8:28 PM UTC

Well after doing all of that, the annoying pop up avg thing has stopped.
I dont understand the kaspersky log much.
but i do appreciate the help.

here is the kaspersky log:

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Friday, January 19, 2007 3:15:19 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 19/01/2007
Kaspersky Anti-Virus database records: 259914
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 58447
Number of viruses found: 7
Number of infected objects: 6 / 0
Number of suspicious objects: 2
Duration of the scan process: 03:37:43

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\PATCH\Application Data\AVG7\Log\emc.log Object is locked skipped
C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cert8.db Object is locked skipped
C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\history.dat Object is locked skipped
C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\key3.db Object is locked skipped
C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\parent.lock Object is locked skipped
C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\search.sqlite Object is locked skipped
C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\PATCH\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Temp\~DF55CA.tmp Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Temp\~DFD4C0.tmp Object is locked skipped
C:\Documents and Settings\PATCH\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\PATCH\My Documents\SpruceDVDPremasterTool.rar/Spruce Premaster Tool.exe Suspicious: Packed.Win32.PePatch.dk skipped
C:\Documents and Settings\PATCH\My Documents\SpruceDVDPremasterTool.rar RAR: suspicious - 1 skipped
C:\Documents and Settings\PATCH\ntuser.dat Object is locked skipped
C:\Documents and Settings\PATCH\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-01-19.00-57-32.log Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E01-loki.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E02.dsr.xvid-crimson.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\The.Shield.S05E03.DSR.XviD-LOKi.avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E04.dsr-loki.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E05.dsr.xvid-omicron.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E06.dsr.xvid-crimson.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E07.dsr-loki.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\The.Shield.S05E08.TVRip.XviD-MiNT.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E09.dsr.xvid-crimson.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E10.dsr.xvid-omicron.[VTV].avi.bc! Object is locked skipped
C:\Program Files\BitComet\Downloads\The Shield Season 5\the.shield.S05E11.dsr-loki.[VTV].avi.bc! Object is locked skipped
C:\Program Files\Common Files\{34ADC619-03A2-1033-0418-010525200001}\Bar888.dll Infected: not-a-virus:AdWare.Win32.Softomate.ac skipped
C:\Program Files\SB\Smart-Browser\BHO.0.1.0.155.dll Infected: not-a-virus:AdWare.Win32.Thingies skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\PATCH.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLog.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\dhtmlexe.exe Infected: Trojan.Win32.Dialer.eg skipped
C:\WINDOWS\SYSTEM32\dowrzsv.exe Infected: not-a-virus:AdWare.Win32.NaviPromo.l skipped
C:\WINDOWS\SYSTEM32\DRIVERS\sptd.sys Object is locked skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\SYSTEM32\msclock32.dll Infected: not-a-virus:AdWare.Win32.NaviPromo.k skipped
C:\WINDOWS\SYSTEM32\sysinetsvc32.dll Infected: not-a-virus:Porn-Dialer.Win32.InstantAccess.e skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\temp\ZLT02191.TMP Object is locked skipped
C:\WINDOWS\temp\ZLT0219e.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

here is the latest hjt log:

Logfile of HijackThis v1.99.1
Scan saved at 3:19:32 PM, on 1/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\The Cleaner\tcm.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\The Cleaner\tca.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\PATCH\My Documents\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.buffalowildwings.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 222.45.36.8:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ams-server*
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Save to &Xdrive - res://C:\Program Files\Xdrive\Xdrive Desktop\xdrive.exe/std.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - http://help.rr.com/Foundrysdccommon/download/tgctlar.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/…svc32_EN_XP.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF42EB50-B9C5-46EA-B09E-5CF0C5AF0BAA}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

IndiGenus

Post #6January 19, 2007, 9:53 PM UTC

Hi St. Thanos,

Certainly glad to hear things are running better. Kaspersky did find some items and we can use Pocket Killbox to clean up.

1) Please download the Killbox.
Save it to the desktop and run it.

2) Select "Delete on Reboot", and then select "All files".

3) Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\Program Files\Common Files\{34ADC619-03A2-1033-0418-010525200001}\Bar888.dll
C:\Program Files\SB\Smart-Browser\BHO.0.1.0.155.dll
C:\WINDOWS\SYSTEM32\dhtmlexe.exe
C:\WINDOWS\SYSTEM32\dowrzsv.exe
C:\WINDOWS\SYSTEM32\msclock32.dll
C:\WINDOWS\SYSTEM32\sysinetsvc32.dll

4) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

5) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

These items lead me to believe you had a Smitfraud infection at one time also.

Let's run that tool also to see if anything is found.

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. It will create a file named:
c:\rapport.txt

Post a new HJT log, the rapport.txt log and let me know how things are running.

Regards,
Dave

St.Thanos

Post #7January 20, 2007, 3:12 AM UTC

Dave,

here is the rapport log

SmitFraudFix v2.132

Scan done at 22:05:13.38, Fri 01/19/2007
Run from C:\Documents and Settings\PATCH\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\migicons.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\PATCH

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\PATCH\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PATCH\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

hjt log:

Logfile of HijackThis v1.99.1
Scan saved at 10:10:17 PM, on 1/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\The Cleaner\tcm.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\The Cleaner\tca.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\notepad.exe
C:\Documents and Settings\PATCH\My Documents\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.buffalowildwings.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 222.45.36.8:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ams-server*
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Save to &Xdrive - res://C:\Program Files\Xdrive\Xdrive Desktop\xdrive.exe/std.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - http://help.rr.com/Foundrysdccommon/download/tgctlar.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/…svc32_EN_XP.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF42EB50-B9C5-46EA-B09E-5CF0C5AF0BAA}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

things are running smooth.. just what these scans are picking up.

IndiGenus

Post #8January 20, 2007, 2:11 PM UTC

Hi St. Thanos,

Running the Clean

Download AVG Anti-Spyware from Here and save that file to your
desktop.
This is a 30 day trial of the program

Once you have downloaded AVG anti-spyware, locate the icon on the desktop
and double-click it to launch the set up program.
Once the setup is complete you will need run AVG Anti-Spyware and update the definition
files.
On the main screen select the icon "Update" then select the "
Update now" link.
- Next select the "Start Update" button, the update will start and a
  progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then
select "Delete".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
______________________________

Warning: running option #2 on a non infected computer will remove your Desktop background.

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

[external image: Posted Image]

The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

______________________________

Clean out your Temporary Internet files. Proceed like this:

Quit Internet Explorer and quit any instances of Windows Explorer.
Click Start, click Control Panel, and then double-click Internet Options.
On the General tab, click Delete Files under Temporary Internet Files.
In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
Click OK.

Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware, and run a full scan.

IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
AVG will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all
actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the
screen and save it as a text file on your Desktop (make sure to remember where you saved that file, this is important).

Close AVG Anti-Spyware and Reboot in Normal Mode.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer Yes to the question "Restore Trusted Zone ?" by typing
Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
______________________________

Please post:
1.c:\rapport.txt
2.AVG Anti-Spyware log
3.A new HijackThis log

Your may need several replies to post the requested logs, otherwise they might get cut off.

Dave

St.Thanos

Post #9January 21, 2007, 8:59 AM UTC

HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 3:58:19 AM, on 1/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\The Cleaner\tcm.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\The Cleaner\tca.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\PATCH\My Documents\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 222.45.36.8:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ams-server*
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1166819473\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Save to &Xdrive - res://C:\Program Files\Xdrive\Xdrive Desktop\xdrive.exe/std.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - http://help.rr.com/Foundrysdccommon/download/tgctlar.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/…svc32_EN_XP.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF42EB50-B9C5-46EA-B09E-5CF0C5AF0BAA}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

St.Thanos

Post #10January 21, 2007, 9:06 AM UTC

rapport.txt: SmitFraudFix v2.132 Scan done at 1:54:23.45, Sun 01/21/2007 Run from C:\Documents and Settings\PATCH\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\migicons.exe Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End avg anti spyware log: ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 3:40:31 AM 1/21/2007 + Scan result: C:\!KillBox\Bar888.dll -> Adware.MaxSearch : Cleaned. C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned. C:\!KillBox\msclock32.dll -> Adware.NaviPromo : Cleaned. HKLM\SOFTWARE\SearchRelevancy -> Adware.SearchRelevancy : Cleaned. HKLM\SOFTWARE\SearchRelevancy\Update -> Adware.SearchRelevancy : Cleaned. C:\!KillBox\BHO.0.1.0.155.dll -> Adware.Thingies : Cleaned. C:\Program Files\DVDFab Decrypter 3\DVDFabDecrypter.exe -> Backdoor.DSNX.05.a : Cleaned. C:\!KillBox\sysinetsvc32.dll -> Dialer.InstantAccess.e : Cleaned. C:\Documents and Settings\PATCH\My Documents\stuff\warez stuff\TMPGEnc DVDAuthor v1.0.4.22 crack\TMPGEnc DVDAuthor crk.exe -> Logger.Banker.zn : Cleaned. C:\Documents and Settings\PATCH\My Documents\stuff\warez stuff\tmpgencdvdauthorv1.0.4.22crackashy.zip/TMPGEnc DVDAuthor v1.0.4.22 crack/TMPGEnc DVDAuthor crk.exe -> Logger.Banker.zn : Cleaned. C:\Program Files\Pegasys Inc\TMPGEnc DVD Author 1.6\TMPGEnc DVDAuthor crk.exe -> Logger.Banker.zn : Cleaned. :mozilla.658:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.247realmedia : Cleaned. :mozilla.660:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.247realmedia : Cleaned. :mozilla.198:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.199:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.237:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.36:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.38:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.396:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.419:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.41:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.42:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.43:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.44:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.45:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.46:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.475:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.47:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.48:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.49:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.50:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.51:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.52:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.53:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.54:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.55:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.56:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.57:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.58:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.59:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.609:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.60:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.61:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.62:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.63:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.64:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.65:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.66:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.67:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.68:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.69:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.70:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.71:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.72:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.73:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.74:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.435:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.437:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.438:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.645:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.647:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.652:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Addynamix : Cleaned. :mozilla.682:C:\Documents and Settings\PATCH\Application

St.Thanos

Post #11January 21, 2007, 9:08 AM UTC

avg scanner report p.2 (the avg scanner log is in 3 parts.) Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.683:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.684:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.353:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.354:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.355:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.356:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.357:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.358:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.13:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.14:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.16:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.17:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.19:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.81:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.251:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.252:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.253:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.254:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.255:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.339:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.340:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.341:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.342:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.343:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.344:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.740:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Clickbank : Cleaned. :mozilla.510:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.511:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.716:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.668:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Commission-junction : Cleaned. :mozilla.670:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Commission-junction : Cleaned. :mozilla.686:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.687:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.688:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.689:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.189:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.348:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.430:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.667:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.130:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.131:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.132:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.133:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.508:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.509:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.517:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.518:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.519:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.521:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.530:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.531:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.532:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.143:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.144:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.145:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.146:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.147:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.148:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.386:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.401:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.402:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.566:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.585:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.366:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.367:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.368:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.384:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.449:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.451:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.487:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.496:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.622:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.697:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.698:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.257:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Information : Cleaned. :mozilla.258:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Information : Cleaned. :mozilla.259:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Information : Cleaned. :mozilla.260:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Information : Cleaned. :mozilla.261:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Information : Cleaned. :mozilla.504:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Masterstats : Cleaned. :mozilla.122:C:\Documents and Settings\PATCH\Application

St.Thanos

Post #12January 21, 2007, 9:10 AM UTC

avg scanner log p.3 Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.123:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.181:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned. :mozilla.182:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned. :mozilla.183:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned. :mozilla.184:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned. :mozilla.345:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.346:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.347:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.450:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.246:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.247:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.248:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.249:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.250:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.420:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Pro-market : Cleaned. :mozilla.423:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Pro-market : Cleaned. :mozilla.369:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.370:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.371:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.262:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.263:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.265:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.220:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.221:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.222:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.223:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.224:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.225:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.226:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.227:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.228:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.229:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.230:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.231:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.232:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.490:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.491:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.492:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.493:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.494:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.495:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.556:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.557:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.558:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.559:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.560:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.561:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.562:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.563:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.564:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.565:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.375:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.376:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.377:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.378:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.152:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.153:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.157:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.158:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.159:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.160:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.161:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.162:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.163:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.149:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.150:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.690:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.691:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.692:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.693:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.694:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.695:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.409:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.134:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.135:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.136:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.137:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.138:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.139:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.140:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.141:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.142:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.424:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.425:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.426:C:\Documents and Settings\PATCH\Application Data\Mozilla\Firefox\Profiles\r0v8fkf0.spyder\cookies.txt -> TrackingCookie.Zedo : Cleaned. C:\!KillBox\dhtmlexe.exe -> Trojan.Dialer.eg : Cleaned. ::Report end

IndiGenus

Post #13January 22, 2007, 1:57 PM UTC

Hi St. Thanos, Looking much better. How are things running at this point? Dave

St.Thanos

Post #14January 22, 2007, 6:22 PM UTC

Things are running smoothly.. i thank you

IndiGenus

Post #15January 22, 2007, 7:00 PM UTC

That's great St. Thanos,

To help keep things clean in the future I recommend the following, along with updating and running your current protection.

Install Spybot - Search and Destroy - Spybot: Search And Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
A tutorial on installing & using this product can be found here:
Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

Install Ad-Aware - Ad-Aware SE You should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
A tutorial on installing & using this product can be found here:
Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Install SpywareGuard - SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.
A tutorial on installing & using this product can be found here:
Using SpywareGuard to protect your computer from Spyware and Malware

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

Here is a great link to a post here on securing your PC after an attack.

http://forums.tomcoyote.org/index.php?show…mp;#entry257163

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Trojan horse Lop.AS

✨ Ask AI

Ask AI