I have been Jacked... PLEASE help..Or come by and see my new CARTOON o

Hello CauseAMess,

Let's try the following:

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

• Install AVG Anti-Spyware by double clicking the installer.
• Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
• On the main screen under Your Computer's security
  • Click on Change state next to Resident shield. It should now change to inactive.
  • Click on Change state next to Automatic updates. It should now change to inactive.
  • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
  • Wait until you see the Update succesfull message.
• Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit.
• Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update AVG Anti-spyware.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
______________________________

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

______________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    • All checkboxes should be ticked.
  • Under Possibly unwanted software:
    • All checkboxes should be ticked.
  • Under Reports:
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    • Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
    [external image: Posted Image]
• When done, click the Save Scan Report button. (4)
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.
______________________________

======
GMER
Please create a new subfolder in the Program Files folder called GMER. If you have an older version of GMER installed, you must delete it.

• Download GMER and extract it to the C:\program files\GMER folder.
  
• Please rename the GMER file
  Note: You can rename gmer.exe to anything you like as long as you keep the .exe ending.
  Run the Gmer.exe renamed program by double-clicking the executable file (gmer.exe) in Windows Explorer.
  You may be prompted to scan immediately if GMER detects rootkit activity.
• If you are prompted to scan your system click "yes" to begin the scan.
• If you are not prompted, Click the "Rootkit" tab, then click "Scan".

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in your next reply.

Please post:

• AVG Anti-spyware log
• the results from the GMER scan
• A new HijackThis log

Your may need several replies to post the requested logs, otherwise they might get cut off.

Hello Susan…. thank you for your assistance !!! I did have a major Printer issue… never had in the past… well it was major to me! Had to reconfig everything… find the problem change name etc… time comsuming for the technologically challenged ! I have followed your instructions and will post a few logs…. would love to post the GMER one, it sent it to my clipboard…. couldn't find clipboard, finally got a hint online and made a shortcut, opened it, and of course there was Nothing on the clipboard…. please help with this! Windows Installer keeps trying to install for Microsoft Office, every time, it fails. I did do a scan using AdAware prior to your instructions and I will post that first/then AVG log hjk.log will be in the next posting, like you mentioned too long! Please help me find that GMER log… it's driving me absolutely nuts! Thank you kindly for all your help, Paula ArchiveData(auto-quarantine- 2007-02-14 20-58-32.bckp) Referencefile : SE1R152 13.02.2007 ====================================================== MRU LIST »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[0]=MRU FileReference : C:\Documents and Settings\USER\recent\6.0.2600.2180.lnk obj[1]=MRU FileReference : C:\Documents and Settings\USER\recent\About You.lnk obj[2]=MRU FileReference : C:\Documents and Settings\USER\recent\Cookie.lnk obj[3]=MRU FileReference : C:\Documents and Settings\USER\recent\coyote.txt (10).lnk obj[4]=MRU FileReference : C:\Documents and Settings\USER\recent\coyote.txt (11).lnk obj[5]=MRU FileReference : C:\Documents and Settings\USER\recent\coyote.txt (12).lnk obj[6]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru\* obj[7]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\recentdocs\.cat obj[8]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\recentdocs\.htm obj[9]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\recentdocs\.txt obj[10]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\recentdocs\.zip obj[11]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\recentdocs\Folder obj[12]=MRU FileReference : C:\Documents and Settings\USER\recent\coyote.txt (8).lnk obj[13]=MRU FileReference : C:\Documents and Settings\USER\recent\coyote.txt (9).lnk obj[14]=MRU FileReference : C:\Documents and Settings\USER\recent\coyote.txt.lnk obj[15]=MRU FileReference : C:\Documents and Settings\USER\recent\GT.txt.lnk obj[16]=MRU FileReference : C:\Documents and Settings\USER\recent\HJK,log8.txt (2).lnk obj[17]=MRU FileReference : C:\Documents and Settings\USER\recent\HJK,log8.txt.lnk obj[18]=MRU FileReference : C:\Documents and Settings\USER\recent\HJK.logs.lnk obj[19]=MRU FileReference : C:\Documents and Settings\USER\recent\HJK.logs9.lnk obj[20]=MRU FileReference : C:\Documents and Settings\USER\recent\Java.lnk obj[21]=MRU FileReference : C:\Documents and Settings\USER\recent\Java.zip.lnk obj[22]=MRU FileReference : C:\Documents and Settings\USER\recent\TcoyoteForum.lnk obj[24]=MRU RegReference : software\microsoft\directdraw\mostrecentapplication name obj[25]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\internet explorer download directory obj[26]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\internet explorer\typedurls obj[27]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\microsoft management console\recent file list obj[28]=MRU RegReference : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru TRACKING COOKIE »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[8]=IECache Entry : Cookie:[removed]/ obj[9]=IECache Entry : Cookie:[removed]/ obj[10]=IECache Entry : Cookie:[removed]/ obj[11]=IECache Entry : Cookie:[removed]/ obj[12]=IECache Entry : Cookie:[removed]/ obj[13]=IECache Entry : Cookie:[removed]/ obj[14]=IECache Entry : Cookie:[removed]/ obj[15]=IECache Entry : Cookie:[removed]/ obj[16]=IECache Entry : Cookie:[removed]/ obj[17]=IECache Entry : Cookie:[removed]/ AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 6:06:19 AM 2/15/2007 + Scan result: C:\Documents and Settings\USER\Cookies\user@2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\USER\Cookies\user@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\USER\Cookies\user@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\USER\Cookies\user@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned. ::Report end

Merged threads, please use [external image: Posted Image] not [external image: Posted Image]

I profusely apologize Teacher ! Sincerely. Duly noted.

Then forget get about the PM

Thank you for the logs. Are you still having problems with the clipboard?


The InfoPath entry from the Mozilla is not malware

InfoPath 2007
Collect and manage data with ease. Extend the reach of your business with rich electronic forms. Get started with the new InfoPath. Download it now, test it out in your browser, or buy it today.
• Download a free trial
• Take an online test drive
• Buy now

Your hijackthis log basically appears to be clean, the GMER log appears to be normal.
Are you still having the problems with MSN with the logon too many times?
STARTDRECK

Download StartDreck

Unzip to its own folder and start the program:
Press 'Config'
Press 'Unmark All'

Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes
Press 'Ok'

Press 'Save' and select the location to save the log file (default is the same folder as the application)

Post (reply) with the log in this thread.

======
Uninstall Manager

Let's see if we can find out what it got installed with.

• Open HijackThis
• Click on the configure button on the bottom right
• Click on the tab "Misc Tools"
• Click on the Box that says "Uninstall Manager"
• Click on the button "Save list"
• Copy and past the List from notepad into your post

Please post (reply) with the log from StartDreck, and the list from hijackthis.

Thank you Susan! No more movies/cartoons.. yeah! MSN is working perfectly Windows Installer is very persistent…. if I accept the download it constantly fails to load!?? Is it safe to say that the hijackers are gone? Worried to send emails if my computer is still sending out 'cookies' to others? In a previous log sent to you, it described that my computer was sending out cookies. Was this true? And how did this happen? From someone hijacking me? Do I keep AdAware, XoftSpySE and AVG anti Spy and run all three just to be safe? I have never used Mozilla, do I keep it? Don't even know what that is, but have read it is not 'good' on for a computer….. through internet sites, to believe or not? Would really like your opinion if you have time…… how to truly delete ie7 for good and what would you suggest to keep any keyloggers away? Is there an anti-logger I can download? Finally, is it in my best interest to get a router? Better security? This is my home PC, no others in the house, just me. Thank you, thank you for your time and expertise !! StartDreck (build 2.1.7 public stable) - 2007-02-15 @ 23:06:33 (GMT -05:00) Platform: Windows XP (Win NT 5.1.2600 Service Pack 2) Internet Explorer: 6.0.2900.2180 Logged in as ****** at **** »Registry »Run Keys »Current User »Run *ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe *SHS="C:\Program Files\Rogers\SelfHealing\SHS.exe" /background *updateMgr="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 »RunOnce »Default User »Run *AVG7_Run=C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE »RunOnce *RunNarrator=Narrator.exe »Local Machine »Run *LXCFCATS=rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16 *ISUSPM Startup="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup *AVG7_CC=C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP *YOP="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 *ISUSScheduler="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start *igfxhkcmd=C:\WINDOWS\system32\hkcmd.exe *dla=C:\WINDOWS\system32\dla\tfswctrl.exe *SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" *ZoneAlarm Client="C:\WINDOWS\ZoneAlarm\zlclient.exe" *!AVG Anti-Spyware="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized +OptionalComponents +MSFS *Installed=1 +MAPI *Installed=1 *NoChange=1 +MAPI *Installed=1 *NoChange=1 »RunOnce »RunServices »RunServicesOnce »RunOnceEx »RunServicesOnceEx »Files »System/Drivers »Running Processes +0= +4= +572=\SystemRoot\System32\smss.exe +620=\??\C:\WINDOWS\system32\csrss.exe +644=\??\C:\WINDOWS\system32\winlogon.exe +688=C:\WINDOWS\system32\services.exe +700=C:\WINDOWS\system32\lsass.exe +880=C:\WINDOWS\system32\svchost.exe +968=C:\WINDOWS\system32\svchost.exe +1064=C:\WINDOWS\System32\svchost.exe +1128=C:\WINDOWS\system32\svchost.exe +1232=C:\WINDOWS\system32\svchost.exe +1244=C:\WINDOWS\system32\ZoneLabs\vsmon.exe +1608=C:\WINDOWS\system32\spoolsv.exe +1896=C:\WINDOWS\Explorer.EXE +152=C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe +180=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe +188=C:\WINDOWS\system32\hkcmd.exe +236=C:\WINDOWS\system32\dla\tfswctrl.exe +280=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe +284=C:\Program Files\Java\jre1.6.0\bin\jusched.exe +372=C:\WINDOWS\ZoneAlarm\zlclient.exe +392=C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe +404=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe +448=C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe +476=C:\WINDOWS\system32\ctfmon.exe +512=C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe +748=C:\WINDOWS\system32\cisvc.exe +1012=C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE +1056=C:\WINDOWS\System32\snmp.exe +2676=C:\WINDOWS\System32\alg.exe +768=C:\Program Files\Internet Explorer\iexplore.exe +1512=C:\WINDOWS\system32\DllHost.exe +3368=C:\WINDOWS\system32\cidaemon.exe +3288=C:\Documents and Settings\USER\Desktop\StartDreck\StartDreck.exe »Application specific ````````````````````````````` Ad-Aware SE Personal Adobe Flash Player 9 ActiveX Adobe Reader 7.0.9 AVG Anti-Spyware 7.5 AVG Free Edition Dell Digital Jukebox Driver Dell Driver Reset Tool Dell Support 3.1 Digital Content Portal High Definition Audio Driver Package - KB835221 HijackThis 1.99.1 Hotfix for Windows XP (KB896344) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB928388) Hotfix for Windows XP (KB929120) Intel® Graphics Media Accelerator Driver Intel® PRO Network Connections Drivers Intel® PROSet for Wired Connections Internet Explorer Default Page Java™ SE Development Kit 6 Java™ SE Runtime Environment 6 Lexmark 730 Series MailFrontier Desktop MCU Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB886903) Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft User-Mode Driver Framework Feature Pack 1.0 MSN Messenger 7.5 MSXML 4.0 SP2 (KB925672) MSXML 4.0 SP2 (KB927978) MyWay Search Assistant ProgramChecker RegCure [removed] Rogers Self Healing Software (remove only) Rogers Yahoo! Applications Security Task Manager 1.7 Security Update for Microsoft .NET Framework 2.0 (KB917283) Security Update for Microsoft .NET Framework 2.0 (KB922770) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB926247) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) SmartUndelete Sonic DLA Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920342) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB931836) Update Manager (remove only) WebCyberCoach 3.2 Dell Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Media Encoder 9 Series Windows Media Encoder 9 Series Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 10 Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885932 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 XoftSpySE ZoneAlarm ``````````````````` HJK log to follow

Update… Just browsing the net, and here they come back… The following log is from AdAware, 11 Critical…. I figure something was happening when my computer screen started shaking. I also found out that 2 ports were closed, yet the site said that was a threat to trojans. RPC and SOCKSPROXY could you assist with this also? Or it's nothing to worry about? Thank you for your time, sincerely. Additional post to follow. Ad-Aware SE Build 1.06r1 Logfile Created on:Friday, February 16, 2007 2:56:57 AM Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R153 15.02.2007 References detected during the scan: MRU List(TAC index:0):4 total references Tracking Cookie(TAC index:3):11 total references Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan within archives Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file 2-16-2007 2:56:57 AM - Scan started. (Full System Scan) MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\internet explorer\typedurls Description : list of recently entered addresses in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\microsoft management console\recent file list Description : list of recent snap-ins used in the microsoft management console MRU List Object Recognized! Location: : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run Listing running processes #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 572 ThreadCreationTime : 2-16-2007 3:50:06 AM BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 620 ThreadCreationTime : 2-16-2007 3:50:07 AM BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 644 ThreadCreationTime : 2-16-2007 3:50:08 AM BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 688 ThreadCreationTime : 2-16-2007 3:50:08 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 700 ThreadCreationTime : 2-16-2007 3:50:09 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 880 ThreadCreationTime : 2-16-2007 3:50:10 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 968 ThreadCreationTime : 2-16-2007 3:50:10 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1064 ThreadCreationTime : 2-16-2007 3:50:10 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1128 ThreadCreationTime : 2-16-2007 3:50:10 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1232 ThreadCreationTime : 2-16-2007 3:50:11 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [vsmon.exe] FilePath : C:\WINDOWS\system32\ZoneLabs\ ProcessID : 1244 ThreadCreationTime : 2-16-2007 3:50:11 AM BasePriority : Normal FileVersion : 7.0.302.000 ProductVersion : 7.0.302.000 ProductName : TrueVector Service CompanyName : Zone Labs, LLC FileDescription : TrueVector Service InternalName : vsmon LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : vsmon.exe #:12 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1608 ThreadCreationTime : 2-16-2007 3:50:17 AM BasePriority : Normal FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) ProductVersion : 5.1.2600.2696 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:13 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1896 ThreadCreationTime : 2-16-2007 3:50:23 AM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:14 [avgcc.exe] FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\ ProcessID : 152 ThreadCreationTime : 2-16-2007 3:50:24 AM BasePriority : Normal FileVersion : 7.5.0.438 ProductVersion : 7.5.0.438 ProductName : AVG Anti-Virus system CompanyName : GRISOFT, s.r.o. FileDescription : AVG Control Center InternalName : AvgCC LegalCopyright : Copyright © 2007 GRISOFT, s.r.o. OriginalFilename : AvgCC.EXE #:15 [issch.exe] FilePath : C:\Program Files\Common Files\InstallShield\UpdateService\ ProcessID : 180 ThreadCreationTime : 2-16-2007 3:50:25 AM BasePriority : Normal FileVersion : 4, 50, 100, 33433 ProductVersion : 4, 50 ProductName : InstallShield Update Service CompanyName : InstallShield Software Corporation FileDescription : InstallShield Update Service Scheduler InternalName : Scheduler LegalCopyright : Copyright © 1990-2004 InstallShield Software Corporation OriginalFilename : issch.exe

Sorry, had a duplicate post.

#:16 [hkcmd.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 188 ThreadCreationTime : 2-16-2007 3:50:25 AM BasePriority : Normal FileVersion : 3.0.0.4410 ProductVersion : 7.0.0.4410 ProductName : Intel® Common User Interface CompanyName : Intel Corporation FileDescription : hkcmd Module InternalName : HKCMD LegalCopyright : Copyright 1999-2004, Intel Corporation OriginalFilename : HKCMD.EXE #:17 [tfswctrl.exe] FilePath : C:\WINDOWS\system32\dla\ ProcessID : 236 ThreadCreationTime : 2-16-2007 3:50:26 AM BasePriority : Normal FileVersion : 1.04.08a CompanyName : Sonic Solutions FileDescription : Drive Letter Access Component LegalCopyright : Copyright © 2004 Sonic Solutions #:18 [guard.exe] FilePath : C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\ ProcessID : 280 ThreadCreationTime : 2-16-2007 3:50:26 AM BasePriority : Normal FileVersion : 7, 5, 0, 47 ProductVersion : 7, 5, 0, 47 ProductName : AVG Anti-Spyware CompanyName : Anti-Malware Development a.s. FileDescription : AVG Anti-Spyware guard InternalName : AVG Anti-Spyware guard LegalCopyright : Copyright © 2006 Anti-Malware Development a.s. OriginalFilename : guard.exe #:19 [jusched.exe] FilePath : C:\Program Files\Java\jre1.6.0\bin\ ProcessID : 284 ThreadCreationTime : 2-16-2007 3:50:26 AM BasePriority : Normal #:20 [zlclient.exe] FilePath : C:\WINDOWS\ZoneAlarm\ ProcessID : 372 ThreadCreationTime : 2-16-2007 3:50:26 AM BasePriority : Normal FileVersion : 7.0.302.000 ProductVersion : 7.0.302.000 ProductName : ZoneAlarm Client CompanyName : Zone Labs, LLC FileDescription : ZoneAlarm Client InternalName : zlclient LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : zlclient.exe #:21 [avgamsvr.exe] FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\ ProcessID : 392 ThreadCreationTime : 2-16-2007 3:50:26 AM BasePriority : Normal FileVersion : 7.5.0.435 ProductVersion : 7.5.0.435 ProductName : AVG Anti-Virus system CompanyName : GRISOFT, s.r.o. FileDescription : AVG Alert Manager InternalName : avgamsvr LegalCopyright : Copyright © 2006 GRISOFT, s.r.o. OriginalFilename : avgamsvr.EXE #:22 [avgupsvc.exe] FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\ ProcessID : 448 ThreadCreationTime : 2-16-2007 3:50:27 AM BasePriority : Normal FileVersion : 7.5.0.420 ProductVersion : 7.5.0.420 ProductName : AVG 7.5 Anti-Virus System CompanyName : GRISOFT, s.r.o. FileDescription : AVG Update Service InternalName : avgupsvc LegalCopyright : Copyright © 2006 GRISOFT, s.r.o. OriginalFilename : avgupdsvc.EXE #:23 [ctfmon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 476 ThreadCreationTime : 2-16-2007 3:50:28 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : CTF Loader InternalName : CTFMON LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : CTFMON.EXE #:24 [avgemc.exe] FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\ ProcessID : 512 ThreadCreationTime : 2-16-2007 3:50:28 AM BasePriority : Normal FileVersion : 7.5.0.434 ProductVersion : 7.5.0.434 ProductName : AVG Anti-Virus system CompanyName : GRISOFT, s.r.o. FileDescription : AVG E-Mail Scanner InternalName : avgemc LegalCopyright : Copyright © 2006 GRISOFT, s.r.o. OriginalFilename : avgemc.exe #:25 [cisvc.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 748 ThreadCreationTime : 2-16-2007 3:50:29 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Content Index service InternalName : cisvc.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : cisvc.exe #:26 [mdm.exe] FilePath : C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\ ProcessID : 1012 ThreadCreationTime : 2-16-2007 3:50:30 AM BasePriority : Normal FileVersion : 7.00.9466 ProductVersion : 7.00.9466 ProductName : Microsoft® Visual Studio .NET CompanyName : Microsoft Corporation FileDescription : Machine Debug Manager InternalName : mdm.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : mdm.exe #:27 [snmp.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1056 ThreadCreationTime : 2-16-2007 3:50:30 AM BasePriority : Normal FileVersion : 5.1.2600.3038 (xpsp_sp2_gdr.061119-2303) ProductVersion : 5.1.2600.3038 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : SNMP Service InternalName : snmp.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : snmp.exe #:28 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2676 ThreadCreationTime : 2-16-2007 3:50:44 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:29 [cidaemon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 3368 ThreadCreationTime : 2-16-2007 3:57:52 AM BasePriority : Idle FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Indexing Service filter daemon InternalName : cidaemon.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : cidaemon.exe #:30 [wuauclt.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 3088 ThreadCreationTime : 2-16-2007 7:48:36 AM BasePriority : Normal FileVersion : 5.8.0.2469 built by: lab01_n(wmbla) ProductVersion : 5.8.0.2469 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Automatic Updates InternalName : wuauclt.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : wuauclt.exe #:31 [regcure.exe] FilePath : C:\Program Files\RegCure\ ProcessID : 3508 ThreadCreationTime : 2-16-2007 7:56:16 AM BasePriority : Normal FileVersion : 1, 0, 0, 50 ProductVersion : 1, 0, 0, 43 ProductName : RegCure Application FileDescription : RegCure Application InternalName : RegCure LegalCopyright : Copyright © 2006 OriginalFilename : RegCure.EXE #:32 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 2520 ThreadCreationTime : 2-16-2007 7:56:37 AM BasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved #:33 [msiexec.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 384 ThreadCreationTime : 2-16-2007 7:56:54 AM BasePriority : Normal Another post to follow.

Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 4 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 4 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 4 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:2 Value : Cookie:[removed]/ Expires : 2-27-2008 7:00:00 PM LastSync : Hits:2 UseCount : 0 Hits : 2 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@adbrite[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:2 Value : Cookie:[removed]/ Expires : 2-16-2008 1:33:44 AM LastSync : Hits:2 UseCount : 0 Hits : 2 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@spylog[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:2 Value : Cookie:[removed]/ Expires : 8-15-2007 12:37:12 AM LastSync : Hits:2 UseCount : 0 Hits : 2 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@2o7[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:2 Value : Cookie:[removed]/ Expires : 2-15-2012 12:27:04 AM LastSync : Hits:2 UseCount : 0 Hits : 2 Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:1 Value : Cookie:[removed]/ Expires : 2-15-2011 2:16:00 AM LastSync : Hits:1 UseCount : 0 Hits : 1 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@tribalfusion[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:5 Value : Cookie:[removed]/ Expires : 2-16-2008 2:17:14 AM LastSync : Hits:5 UseCount : 0 Hits : 5 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@casalemedia[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:4 Value : Cookie:[removed]/ Expires : 2-6-2008 8:33:44 PM LastSync : Hits:4 UseCount : 0 Hits : 4 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@atdmt[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:3 Value : Cookie:[removed]/ Expires : 2-14-2012 7:00:00 PM LastSync : Hits:3 UseCount : 0 Hits : 3 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@tacoda[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:6 Value : Cookie:[removed]/ Expires : 2-11-2008 1:34:02 AM LastSync : Hits:6 UseCount : 0 Hits : 6 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@doubleclick[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:3 Value : Cookie:[removed]/ Expires : 2-15-2010 1:33:44 AM LastSync : Hits:3 UseCount : 0 Hits : 3 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@hotlog[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:1 Value : Cookie:[removed]/ Expires : 2-16-2008 12:37:10 AM LastSync : Hits:1 UseCount : 0 Hits : 1 Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 11 Objects found so far: 15 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 15 Scanning Hosts file…… Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 10 entries scanned. New critical objects:0 Objects found so far: 15 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 15 3:07:38 AM Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:10:40.641 Objects scanned:125052 Objects identified:11 Objects ignored:0 New critical objects:11 AdAware took care of all the above, my concern…. why are they coming back….. even the movie is back on my screen? I am beginning to think it may be Zone Alarm ? So many blocked intrusions tonight, I blocked Download.exe on ZA… and it still allowed it to go through… wondering about the 2 ports. I am going to run a bunch of scans and hopefully get some sleep !!! As my brain is like this-