I have been Jacked... PLEASE help..Or come by and see my new CARTOON o

Please explain about the download.exe. It did not show up in logs yet you just mentioned it.

Please test your firewall and make sure it is working properly. Let me know the results.
Test Firewall

Download.exe is in my program controls for AVG Firewall, there is 5 of them, ALL blocked. Had a BlueScreenofDeath a day ago as well as browser hijacked to msn.com then opened another window that was sympatico.ca…. RegCure has said that my browser may have been hijacked due to the changing of my homepage a couple of times. Had the movie return, as soon as I run Adware or XsoftSpySE, it is gone. Also AVG Virus picked up the following: shell32.dll "changed" C:\WINDOWS\system32\shell32.dll hosts "changed" C:\WINDOWS\system32\drivers\etc\hosts This is the AVG report from when I logged on this morning VG Anti-Spyware - Scan Report ——————————————————— + Created at: 4:58:54 AM 2/18/2007 + Scan result: C:\Documents and Settings\USER\Cookies\user@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\USER\Cookies\user@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned. C:\Documents and Settings\USER\Cookies\user@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\USER\Cookies\[removed]-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned. C:\Documents and Settings\USER\Cookies\user@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned. `````````````````````````````````` The ports from HackerWatch as follows: HackerWatch : Secure 21 (FTP) This port is completely invisible to the outside world. Secure 23 (Telnet) This port is completely invisible to the outside world. Secure 25 (SMTP Mail Server Port) This port is completely invisible to the outside world. Secure 79 (Finger) This port is completely invisible to the outside world. Secure 80 (HTTP) This port is completely invisible to the outside world. Secure 110 (POP3 Mail Server Port) This port is completely invisible to the outside world. Secure 139 (Net BIOS) This port is completely invisible to the outside world. Secure 143 (IMAP) This port is completely invisible to the outside world. Secure 443 (HTTPS) This port is completely invisible to the outside world. Test complete. No open ports were found. ```````````````````````````````````````` Using a simple probe : Traffic Sent Packets were successfully sent to your computer. The server was unable to obtain a connection or any traffic from your computer. This generally indicates that your firewall blocked the traffic successfully. If you did not see an event warning it may indicate that the traffic did not reach your computer at all. This could be due to any of the following reasons: You are connecting to the Internet through a proxy server. When we attempted to connect back to the IP address your web traffic came from we actually were connecting to the proxy server, not your computer. You are behind a corporate firewall which is redirecting traffic in an unexpected manner. You are connecting to the Internet through a NAT (network address translator). When we attempted to connect back to the IP address your web traffic came from we actually were connecting to the proxy server, not your computer. In any of these cases you will not see an event notification on your computer because our connection attempt did not reach your computer. In any case, your computer is secure. ``````````````````````````````````` PC Flank : Results of Advanced Port Scanner TCP CONNECT scanning (scanned in 30 seconds) We have scanned your computer' ports used by the most widespread trojan horses. Here is the description of possible ports' statuses: "Stealthed" (by a firewall) -Means that your computer is invisible to others on the Internet and protected by a firewall or other similiar software; "Closed" (non-stealthed) - means that this port is closed, but your computer is visible to others on the Internet that can be potentially dangerous; "Open" - Means that this port is ready to establish (or has already established) a connection with remote address. It also means that your computer is vulnerable to attacks and could have been already hacked or infected by a trojan/backdoor; Port: Status Service Description 21 stealthed FTP File Transfer Protocol is used to transfer files between computers 23 stealthed TELNET Telnet is used to remotely create a shell (dos prompt) 80 stealthed HTTP HTTP web services publish web pages 137 stealthed NETBIOS Name Service NetBios is used to share files through your Network Neighborhood 138 stealthed NETBIOS Datagram Service NetBios is used to share files through your Network Neighborhood 139 stealthed NETBIOS Session Service NetBios is used to share files through your Network Neighborhood 1243 stealthed SubSeven SubSeven is one of the most widespread trojans 3128 stealthed Masters Paradise and RingZero Trojan horses 12345 stealthed NetBus NetBus is one of the most widespread trojans 12348 stealthed BioNet BioNet is one of the most widespread trojan 27374 stealthed SubSeven SubSeven is one of the most widespread trojans 31337 stealthed Back Orifice Back Orifice is one of the most widespread trojans 135 closed RPC Remote Procedure Call (RPC) is used in client/server applications based on MS Windows operating systems 1080 closed SOCKS PROXY Socks Proxy is an internet proxy service Recommendation: Install personal firewall software. PC Flank recommends Outpost Firewall Pro. If you have already installed and are using a firewall, check if it is set to make all the ports of your computer stealthed (invisible). If it is, then get new firewall software and redo this test. AVG Firewall is all stealthed, used LeakTest and always comes up fine as I am writing this the movie is now returning. 2 HJK logs to follow, the first taken at computer start up, the next two hours later = present time.

This is a scan to show the critical objects after browsing internet……. Ad-Aware SE Build 1.06r1 Logfile Created on:Sunday, February 18, 2007 6:57:56 AM Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R153 15.02.2007 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» MRU List(TAC index:0):7 total references Tracking Cookie(TAC index:3):6 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan within archives Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file 2-18-2007 6:57:56 AM - Scan started. (Full System Scan) MRU List Object Recognized! Location: : C:\Documents and Settings\USER\recent Description : list of recently opened documents MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\internet explorer Description : last download directory used in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\internet explorer\typedurls Description : list of recently entered addresses in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-3805796006-14762468-2840279162-1006\software\microsoft\windows\currentversion\explorer\recentdocs Description : list of recent documents opened Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 572 ThreadCreationTime : 2-18-2007 8:53:12 AM BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 620 ThreadCreationTime : 2-18-2007 8:53:16 AM BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 644 ThreadCreationTime : 2-18-2007 8:53:17 AM BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 688 ThreadCreationTime : 2-18-2007 8:53:20 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 700 ThreadCreationTime : 2-18-2007 8:53:20 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 888 ThreadCreationTime : 2-18-2007 8:53:26 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 996 ThreadCreationTime : 2-18-2007 8:53:28 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1104 ThreadCreationTime : 2-18-2007 8:53:29 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1164 ThreadCreationTime : 2-18-2007 8:53:29 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1292 ThreadCreationTime : 2-18-2007 8:53:30 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [vsmon.exe] FilePath : C:\WINDOWS\system32\ZoneLabs\ ProcessID : 1304 ThreadCreationTime : 2-18-2007 8:53:30 AM BasePriority : Normal FileVersion : 7.0.302.000 ProductVersion : 7.0.302.000 ProductName : TrueVector Service CompanyName : Zone Labs, LLC FileDescription : TrueVector Service InternalName : vsmon LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : vsmon.exe #:12 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1664 ThreadCreationTime : 2-18-2007 8:53:42 AM BasePriority : Normal FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) ProductVersion : 5.1.2600.2696 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:13 [guard.exe] FilePath : C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\ ProcessID : 1768 ThreadCreationTime : 2-18-2007 8:53:49 AM BasePriority : Normal FileVersion : 7, 5, 0, 47 ProductVersion : 7, 5, 0, 47 ProductName : AVG Anti-Spyware CompanyName : Anti-Malware Development a.s. FileDescription : AVG Anti-Spyware guard InternalName : AVG Anti-Spyware guard LegalCopyright : Copyright © 2006 Anti-Malware Development a.s. OriginalFilename : guard.exe #:14 [avgamsvr.exe] FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\ ProcessID : 1780 ThreadCreationTime : 2-18-2007 8:53:49 AM BasePriority : Normal FileVersion : 7.5.0.435 ProductVersion : 7.5.0.435 ProductName : AVG Anti-Virus system CompanyName : GRISOFT, s.r.o. FileDescription : AVG Alert Manager InternalName : avgamsvr LegalCopyright : Copyright © 2006 GRISOFT, s.r.o. OriginalFilename : avgamsvr.EXE

#:15 [avgupsvc.exe] FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\ ProcessID : 1820 ThreadCreationTime : 2-18-2007 8:53:50 AM BasePriority : Normal FileVersion : 7.5.0.420 ProductVersion : 7.5.0.420 ProductName : AVG 7.5 Anti-Virus System CompanyName : GRISOFT, s.r.o. FileDescription : AVG Update Service InternalName : avgupsvc LegalCopyright : Copyright © 2006 GRISOFT, s.r.o. OriginalFilename : avgupdsvc.EXE #:16 [avgemc.exe] FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\ ProcessID : 1840 ThreadCreationTime : 2-18-2007 8:53:50 AM BasePriority : Normal FileVersion : 7.5.0.434 ProductVersion : 7.5.0.434 ProductName : AVG Anti-Virus system CompanyName : GRISOFT, s.r.o. FileDescription : AVG E-Mail Scanner InternalName : avgemc LegalCopyright : Copyright © 2006 GRISOFT, s.r.o. OriginalFilename : avgemc.exe #:17 [cisvc.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1864 ThreadCreationTime : 2-18-2007 8:53:50 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Content Index service InternalName : cisvc.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : cisvc.exe #:18 [mdm.exe] FilePath : C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\ ProcessID : 1900 ThreadCreationTime : 2-18-2007 8:53:51 AM BasePriority : Normal FileVersion : 7.00.9466 ProductVersion : 7.00.9466 ProductName : Microsoft® Visual Studio .NET CompanyName : Microsoft Corporation FileDescription : Machine Debug Manager InternalName : mdm.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : mdm.exe #:19 [snmp.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1936 ThreadCreationTime : 2-18-2007 8:53:52 AM BasePriority : Normal FileVersion : 5.1.2600.3038 (xpsp_sp2_gdr.061119-2303) ProductVersion : 5.1.2600.3038 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : SNMP Service InternalName : snmp.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : snmp.exe #:20 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1084 ThreadCreationTime : 2-18-2007 8:54:01 AM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:21 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1876 ThreadCreationTime : 2-18-2007 8:54:14 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:22 [avgcc.exe] FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\ ProcessID : 492 ThreadCreationTime : 2-18-2007 8:54:15 AM BasePriority : Normal FileVersion : 7.5.0.438 ProductVersion : 7.5.0.438 ProductName : AVG Anti-Virus system CompanyName : GRISOFT, s.r.o. FileDescription : AVG Control Center InternalName : AvgCC LegalCopyright : Copyright © 2007 GRISOFT, s.r.o. OriginalFilename : AvgCC.EXE #:23 [issch.exe] FilePath : C:\Program Files\Common Files\InstallShield\UpdateService\ ProcessID : 1236 ThreadCreationTime : 2-18-2007 8:54:19 AM BasePriority : Normal FileVersion : 4, 50, 100, 33433 ProductVersion : 4, 50 ProductName : InstallShield Update Service CompanyName : InstallShield Software Corporation FileDescription : InstallShield Update Service Scheduler InternalName : Scheduler LegalCopyright : Copyright © 1990-2004 InstallShield Software Corporation OriginalFilename : issch.exe #:24 [hkcmd.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2104 ThreadCreationTime : 2-18-2007 8:54:21 AM BasePriority : Normal FileVersion : 3.0.0.4410 ProductVersion : 7.0.0.4410 ProductName : Intel® Common User Interface CompanyName : Intel Corporation FileDescription : hkcmd Module InternalName : HKCMD LegalCopyright : Copyright 1999-2004, Intel Corporation OriginalFilename : HKCMD.EXE #:25 [tfswctrl.exe] FilePath : C:\WINDOWS\system32\dla\ ProcessID : 2172 ThreadCreationTime : 2-18-2007 8:54:22 AM BasePriority : Normal FileVersion : 1.04.08a CompanyName : Sonic Solutions FileDescription : Drive Letter Access Component LegalCopyright : Copyright © 2004 Sonic Solutions #:26 [jusched.exe] FilePath : C:\Program Files\Java\jre1.6.0\bin\ ProcessID : 2220 ThreadCreationTime : 2-18-2007 8:54:23 AM BasePriority : Normal #:27 [zlclient.exe] FilePath : C:\WINDOWS\ZoneAlarm\ ProcessID : 2304 ThreadCreationTime : 2-18-2007 8:54:26 AM BasePriority : Normal FileVersion : 7.0.302.000 ProductVersion : 7.0.302.000 ProductName : ZoneAlarm Client CompanyName : Zone Labs, LLC FileDescription : ZoneAlarm Client InternalName : zlclient LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : zlclient.exe #:28 [ctfmon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2360 ThreadCreationTime : 2-18-2007 8:54:29 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : CTF Loader InternalName : CTFMON LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : CTFMON.EXE #:29 [cidaemon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 3884 ThreadCreationTime : 2-18-2007 9:01:05 AM BasePriority : Idle FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Indexing Service filter daemon InternalName : cidaemon.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : cidaemon.exe #:30 [avgas.exe] FilePath : C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\ ProcessID : 2868 ThreadCreationTime : 2-18-2007 9:13:20 AM BasePriority : Normal FileVersion : 7, 5, 0, 50 ProductVersion : 7, 5, 0, 50 ProductName : AVG Anti-Spyware CompanyName : Anti-Malware Development a.s. FileDescription : AVG Anti-Spyware InternalName : AVG Anti-Spyware LegalCopyright : Copyright © 2006 Anti-Malware Development a.s. OriginalFilename : avgas.exe #:31 [xoftspy.exe] FilePath : C:\Program Files\XoftSpySE\ ProcessID : 3364 ThreadCreationTime : 2-18-2007 11:56:43 AM BasePriority : Normal FileVersion : 4, 29, 0, 7 ProductVersion : 4, 27, 0, 0 ProductName : Xoftspy CompanyName : ParetoLogic FileDescription : Xoftspy InternalName : Xoftspy LegalCopyright : Copyright © 2006 OriginalFilename : xoftspy.exe #:32 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 1244 ThreadCreationTime : 2-18-2007 11:57:43 AM BasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved

Sorry for all the posts, as they do not fit the post length. Just wanted you to see what I am facing when I log on, and after a browsing session. Concerned with those 2 HJK.logs, re: 01 hosts……. O1 - Hosts: This file contains the mappings of IP addresses to host names. Each O1 - Hosts: entry should be kept on an individual line. The IP address should O1 - Hosts: be placed in the first column followed by the corresponding host name. O1 - Hosts: The IP address and the host name should be separated by at least one O1 - Hosts: space. O1 - Hosts: Additionally, comments (such as these) may be inserted on individual O1 - Hosts: lines or following the machine name denoted by a '#' symbol. O1 - Hosts: For example: O1 - Hosts: 102.54.94.97 rhino.acme.com # source server O1 - Hosts: 38.25.63.10 x.acme.com # x client host I have NEVER responded to citibank emails, EVER, although used online banking, last time was Jan 26/07 ads I had a hunch something was terribly wrong with my system. No red flags to date re: my credit cards, banking etc. Spoke to my online banking, they have totally removed access to it, I can no longer use online banking, nor can the jackthis idiot. Spoke to Citibank, decreased limit, and logged current computer issues. As well as with Visa and tomorrow when they are available, Mastercard. I Never had my abm/atm access card online, they said it shouldn't pose an issue, because it has never been logged online. I will now run a free version of F-Secure, looking for trojans, In your opinion, would it just be best to re-format hard drive? Also should I consider utilizing FireFox in the future? Or stick with IE6, or anything you suggest? I sincerely do not want to go thru this ever again….ever. Very scary for me and I am sure for others who have been down this road. The remaining AdAware log…. Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 7 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 7 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 7 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : user@serving-sys[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:10 Value : Cookie:[removed]/ Expires : 12-31-2037 5:00:00 PM LastSync : Hits:10 UseCount : 0 Hits : 10 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@2o7[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:8 Value : Cookie:[removed]/ Expires : 2-17-2012 6:49:16 AM LastSync : Hits:8 UseCount : 0 Hits : 8 Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed][1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:1 Value : Cookie:[removed]/ Expires : 2-17-2011 5:52:54 AM LastSync : Hits:1 UseCount : 0 Hits : 1 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@bluestreak[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:4 Value : Cookie:[removed]/ Expires : 2-15-2017 1:49:10 AM LastSync : Hits:4 UseCount : 0 Hits : 4 Tracking Cookie Object Recognized! Type : IECache Entry Data : [removed]-sys[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:1 Value : Cookie:[removed]/ Expires : 12-31-2037 5:00:00 PM LastSync : Hits:1 UseCount : 0 Hits : 1 Tracking Cookie Object Recognized! Type : IECache Entry Data : user@doubleclick[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:5 Value : Cookie:[removed]/ Expires : 2-17-2010 5:12:30 AM LastSync : Hits:5 UseCount : 0 Hits : 5 Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 6 Objects found so far: 13 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 13 Scanning Hosts file…… Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 10 entries scanned. New critical objects:0 Objects found so far: 13 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 13 7:07:27 AM Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:09:31.203 Objects scanned:121502 Objects identified:6 Objects ignored:0 New critical objects:6 Bless your heart for your patience and guidance with/for me.

I uninstalled AVG anti Virus, spyware and firewall. Installed F-Secure. Concerned about files that were denied access and not scanned…. ie.. hibernation, I found out I can turn this off, do I? Scanning type: Perform full computer check Target: C:\ + system + rootkits ——————————————————————————– Result: 1 malware found Possible Browser Hijack attempt (Misc) FILE:C:\Documents and Settings\USER\Favorites\Song Lyrics\Above & Beyond Lyrics Can't Sleep.url Action: quarantined ——————————————————————————– Statistics Scanned: Files: 245180 Not scanned: 4 Result: Viruses: 0 Spyware: 1 Suspicious items: 0 Riskware: 0 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 Quarantined: 1 Failed: 0 Boot Sectors: Scanned: 1 Infected: 0 Suspicious items: 0 Disinfected: 0 Files not scanned: Cannot open file C:\HIBERFIL.SYS Cannot open file C:\PAGEFILE.SYS Cannot open file C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT File C:\Documents and Settings\All Users\Application Data\Zenturi\ProgramChecker\Data\RuleXML_633054163651875000~5_1_2.zip\RuleXML_633054163651875000~5_1_2.xml is encrypted

135 closed RPC Remote Procedure Call (RPC) is used in client/server applications based on MS Windows operating systems
1080 closed SOCKS PROXY Socks Proxy is an internet proxy service

This concerns me. You said that you uninstalled AVG anti-virus, spyware and firewall? Now are those ports stealthed when you test the firewall?

Please post (reply) with another hijackthis log. Please post the results of another firewall test.

We do not place much stock in the Windows XP firewall. Using a software firewall other than the XP firewall will allow you to give/deny access for applications that want to go online.

I do not know much about firewalls but this still concerns me.

All PC Flank's tests:
Exploits = system defended itself from this attack.
Trojans = No trojans
Browser = Danger, 135 open to everyone, "referrer" is enabled, trojan is safe
Ports = 135 / 1080 closed, but all others are stealthed

Basically there is not much to fix in your hijackthis log. There are entries that could be deleted to tidy it up because they are incomplete. But I have been more concerned with locating malware. I have not found anything yet.

I would recommend using a router(with firewall) in addition to a software firewall.

I use Firefox instead of IE.

Here are a couple of links which may provide you with additional valuable information:
When should I re-format? How should I reinstall?
http://www.dslreports.com/faq/10063

Hello Susan, Thank you for all of your responses. I will get that router with firewall. As for a regular firewall/software, I am now using F-Secure. Although, I am thinking of using Outpost Firewall from PC Flank's website. After reading up on CWS.Oslogo…… wherever it came from, my computer does have the characteristics that this presents. It shows up when I thought it was removed, have had many fake pop ups… etc etc Whether I do a re-format or not, thank you for that link, I will definitely be using another browser…. I only hear good things about firefox. Probably will do that re-format, I am very lucky to have people in my life that do this for a living, too bad we are not in the same cities. I sincerely thank you for your expertise. Paula

Here is the Spy Sweeper log….. only have had cookies…. Zango… its quarantined. 5:20 PM: ApplicationMinimized - EXIT 5:20 PM: ApplicationMinimized - ENTER 5:19 PM: ApplicationMinimized - EXIT 5:19 PM: ApplicationMinimized - ENTER 5:08 PM: None 5:08 PM: Traces Found: 0 5:08 PM: Full Sweep has completed. Elapsed time 00:16:17 5:08 PM: File Sweep Complete, Elapsed Time: 00:10:14 5:08 PM: ApplicationMinimized - EXIT 5:08 PM: ApplicationMinimized - EXIT 5:08 PM: ApplicationMinimized - ENTER 5:08 PM: ApplicationMinimized - ENTER 5:04 PM: Warning: SweepDirectories: Cannot find directory "d:". This directory was not added to the list of paths to be scanned. 5:04 PM: Warning: Failed to open file "c:\documents and settings\user\application data\mozilla\firefox\profiles\0joooyv3.default\parent.lock". The operation completed successfully 5:00 PM: ApplicationMinimized - EXIT 5:00 PM: ApplicationMinimized - EXIT 5:00 PM: ApplicationMinimized - ENTER 5:00 PM: ApplicationMinimized - ENTER 4:58 PM: Starting File Sweep 4:58 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 4:58 PM: Starting Cookie Sweep 4:58 PM: Registry Sweep Complete, Elapsed Time:00:00:25 4:58 PM: ApplicationMinimized - EXIT 4:58 PM: ApplicationMinimized - EXIT 4:58 PM: ApplicationMinimized - ENTER 4:58 PM: ApplicationMinimized - ENTER 4:57 PM: Starting Registry Sweep 4:57 PM: Memory Sweep Complete, Elapsed Time: 00:05:52 4:57 PM: ApplicationMinimized - EXIT 4:57 PM: ApplicationMinimized - EXIT 4:57 PM: ApplicationMinimized - ENTER 4:57 PM: ApplicationMinimized - ENTER 4:56 PM: ApplicationMinimized - EXIT 4:56 PM: ApplicationMinimized - ENTER 4:56 PM: ApplicationMinimized - EXIT 4:56 PM: ApplicationMinimized - ENTER 4:56 PM: ApplicationMinimized - EXIT 4:56 PM: ApplicationMinimized - ENTER 4:52 PM: Starting Memory Sweep 4:51 PM: Start Full Sweep 4:51 PM: Sweep initiated using definitions version 866 Operation: File Access Target: Source: C:\WINDOWS\SYSTEM32\CIDAEMON.EXE 4:04 PM: Tamper Detection Operation: File Access Target: Source: C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE 3:28 PM: Tamper Detection 3:28 PM: Your definitions are up to date. 3:27 PM: Automated check for program update in progress. Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 3:27 PM: Shield States 3:27 PM: Spyware Definitions: 866 3:27 PM: Spy Sweeper 5.3.1.2344 started 3:27 PM: Spy Sweeper 5.3.1.2344 started 3:27 PM: | Start of Session, Sunday, February 25, 2007 | *************** 2:24 AM: ApplicationMinimized - EXIT 2:24 AM: ApplicationMinimized - ENTER 2:24 AM: Your definitions are up to date. 2:23 AM: Your definitions are up to date. 2:21 AM: Your definitions are up to date. 2:18 AM: Your definitions are up to date. 2:15 AM: Your definitions are up to date. 1:49 AM: Spy Installation Shield: found: Adware: 180search assistant/zango, version 1.0.0.0 Operation: File Access Target: Source: C:\WINDOWS\SYSTEM32\CIDAEMON.EXE 12:58 AM: Tamper Detection Operation: File Access Target: Source: C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE 12:51 AM: Tamper Detection 12:47 AM: ApplicationMinimized - EXIT 12:47 AM: ApplicationMinimized - ENTER 12:47 AM: None 12:47 AM: Traces Found: 0 12:47 AM: Context Folder Sweep has completed. Elapsed time 00:00:05 12:47 AM: File Sweep Complete, Elapsed Time: 00:00:04 12:47 AM: Starting File Sweep 12:47 AM: Start Context Folder Sweep 12:47 AM: Sweep initiated using definitions version 866 Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 12:40 AM: Shield States 12:40 AM: Spyware Definitions: 866 12:40 AM: Spy Sweeper 5.3.1.2344 started 12:40 AM: Spy Sweeper 5.3.1.2344 started 12:40 AM: | Start of Session, Saturday, February 24, 2007 | *************** Operation: File Access Target: Source: C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE 2:33 AM: Tamper Detection Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 2:28 AM: Shield States 2:28 AM: Spyware Definitions: 866 2:28 AM: Spy Sweeper 5.3.1.2344 started 2:28 AM: Spy Sweeper 5.3.1.2344 started 2:28 AM: | Start of Session, Saturday, February 24, 2007 | *************** 7:26 AM: IE Hijack Shield: Blacklisted change blocked. 7:26 AM: ApplicationMinimized - EXIT 7:26 AM: ApplicationMinimized - ENTER 7:26 AM: Internet Explorer internal web pages restored to protected values 7:26 AM: IE Hijack Shield: Resetting IE advanced data value. 7:25 AM: IE Hijack Shield: Resetting Home Page value. 7:22 AM: ApplicationMinimized - EXIT 7:22 AM: ApplicationMinimized - ENTER 7:22 AM: None 7:22 AM: Traces Found: 0 7:22 AM: Context File Sweep has completed. Elapsed time 00:00:00 7:22 AM: File Sweep Complete, Elapsed Time: 00:00:00 7:22 AM: Starting File Sweep 7:22 AM: Start Context File Sweep 7:22 AM: Sweep initiated using definitions version 866 6:46 AM: ApplicationMinimized - EXIT 6:46 AM: ApplicationMinimized - ENTER 6:46 AM: None 6:46 AM: Traces Found: 0 6:46 AM: Context File Sweep has completed. Elapsed time 00:00:00 6:46 AM: File Sweep Complete, Elapsed Time: 00:00:00 6:46 AM: Starting File Sweep 6:45 AM: Start Context File Sweep 6:45 AM: Sweep initiated using definitions version 866 6:04 AM: ApplicationMinimized - EXIT 6:04 AM: ApplicationMinimized - ENTER 5:34 AM: ApplicationMinimized - EXIT 5:34 AM: ApplicationMinimized - ENTER 5:28 AM: Hosts File Shield: On 5:27 AM: Hosts File Shield: Off 5:25 AM: Warning: Could not store new IE Hijack Setting value: HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL\http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch Error: Failed to set data for 'Default_Search_URL' 5:25 AM: Warning: Could not store new IE Hijack Setting value: HKLM\Software\Microsoft\Internet Explorer\Main\Default_Page_URL\http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6ar=msnhome Error: Failed to set data for 'Default_Page_URL' 5:25 AM: Warning: Could not store new IE Hijack Setting value: HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch\http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchcust.htm Error: Failed to set data for 'CustomizeSearch' 5:25 AM: Warning: Could not store new IE Hijack Setting value: HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant\http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm Error: Failed to set data for 'SearchAssistant' 5:25 AM: Warning: Could not store new IE Hijack Setting value: HKCU\Software\Microsoft\Internet Explorer\Main\Search Page\http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch Error: Failed to set data for 'Search Page' 5:23 AM: Hosts File Shield: On 5:23 AM: Hosts File Shield: Off 5:22 AM: IE Tracking Cookies Shield: Removed 2o7.net cookie 5:22 AM: IE Tracking Cookies Shield: Removed 2o7.net cookie 5:21 AM: IE Tracking Cookies Shield: Removed pointroll cookie 5:15 AM: ApplicationMinimized - EXIT 5:15 AM: ApplicationMinimized - ENTER 5:15 AM: None 5:15 AM: Traces Found: 0 5:15 AM: Context File Sweep has completed. Elapsed time 00:00:00 5:15 AM: File Sweep Complete, Elapsed Time: 00:00:00 5:15 AM: Starting File Sweep 5:15 AM: Start Context File Sweep 5:15 AM: Sweep initiated using definitions version 866 5:15 AM: ApplicationMinimized - EXIT 5:15 AM: ApplicationMinimized - ENTER 5:15 AM: None 5:15 AM: Traces Found: 0 5:15 AM: Context File Sweep has completed. Elapsed time 00:00:00 5:15 AM: File Sweep Complete, Elapsed Time: 00:00:00 5:15 AM: Starting File Sweep 5:15 AM: Start Context File Sweep 5:15 AM: Sweep initiated using definitions version 866 5:14 AM: ApplicationMinimized - EXIT 5:14 AM: ApplicationMinimized - ENTER 5:14 AM: None 5:14 AM: Traces Found: 0 5:14 AM: Context File Sweep has completed. Elapsed time 00:00:00 5:14 AM: File Sweep Complete, Elapsed Time: 00:00:00 5:14 AM: Starting File Sweep 5:14 AM: Start Context File Sweep 5:14 AM: Sweep initiated using definitions version 866 5:14 AM: ApplicationMinimized - EXIT 5:14 AM: ApplicationMinimized - ENTER 5:14 AM: None 5:14 AM: Traces Found: 0 5:14 AM: Context Folder Sweep has completed. Elapsed time 00:00:11 5:14 AM: File Sweep Complete, Elapsed Time: 00:00:09 5:13 AM: Starting File Sweep 5:13 AM: Start Context Folder Sweep 5:13 AM: Sweep initiated using definitions version 866 5:12 AM: ApplicationMinimized - EXIT 5:12 AM: ApplicationMinimized - ENTER 5:12 AM: None 5:12 AM: Traces Found: 0 5:12 AM: Context Folder Sweep has completed. Elapsed time 00:00:06 5:12 AM: File Sweep Complete, Elapsed Time: 00:00:05 5:12 AM: Starting File Sweep 5:12 AM: Start Context Folder Sweep 5:12 AM: Sweep initiated using definitions version 866 5:11 AM: ApplicationMinimized - EXIT 5:11 AM: ApplicationMinimized - ENTER 5:10 AM: None 5:10 AM: Traces Found: 0 5:10 AM: Context File Sweep has completed. Elapsed time 00:00:00 5:10 AM: File Sweep Complete, Elapsed Time: 00:00:00 5:10 AM: Starting File Sweep 5:10 AM: Start Context File Sweep 5:10 AM: Sweep initiated using definitions version 866 5:09 AM: ApplicationMinimized - EXIT 5:09 AM: ApplicationMinimized - ENTER 5:09 AM: None 5:09 AM: Traces Found: 0 5:09 AM: Context Folder Sweep has completed. Elapsed time 00:00:05 5:09 AM: File Sweep Complete, Elapsed Time: 00:00:04 5:09 AM: Starting File Sweep 5:09 AM: Start Context Folder Sweep 5:09 AM: Sweep initiated using definitions version 866 5:08 AM: ApplicationMinimized - EXIT 5:08 AM: ApplicationMinimized - ENTER 5:08 AM: None 5:08 AM: Traces Found: 0 5:08 AM: Context Folder Sweep has completed. Elapsed time 00:00:05 5:08 AM: File Sweep Complete, Elapsed Time: 00:00:04 5:08 AM: Starting File Sweep 5:08 AM: Start Context Folder Sweep 5:08 AM: Sweep initiated using definitions version 866 5:07 AM: ApplicationMinimized - EXIT 5:07 AM: ApplicationMinimized - ENTER 5:07 AM: None 5:07 AM: Traces Found: 0 5:07 AM: Context File Sweep has completed. Elapsed time 00:00:00 5:07 AM: File Sweep Complete, Elapsed Time: 00:00:00 5:07 AM: Starting File Sweep 5:07 AM: Start Context File Sweep 5:07 AM: Sweep initiated using definitions version 866 5:03 AM: IE Hijack Shield: Resetting IE advanced data value. 4:58 AM: IE Tracking Cookies Shield: Removed serving-sys cookie 4:58 AM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 4:58 AM: IE Tracking Cookies Shield: Removed serving-sys cookie 4:58 AM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 4:46 AM: IE Tracking Cookies Shield: Removed mediaplex cookie 4:37 AM: IE Tracking Cookies Shield: Removed serving-sys cookie 4:37 AM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 4:37 AM: IE Tracking Cookies Shield: Removed 2o7.net cookie 4:37 AM: IE Tracking Cookies Shield: Removed 2o7.net cookie 4:37 AM: IE Tracking Cookies Shield: Removed bluestreak cookie 4:37 AM: IE Tracking Cookies Shield: Removed serving-sys cookie 4:37 AM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 4:25 AM: IE Tracking Cookies Shield: Removed serving-sys cookie 4:25 AM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 4:24 AM: IE Tracking Cookies Shield: Removed serving-sys cookie 4:24 AM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 4:20 AM: Shield States 4:19 AM: Spyware Definitions: 866 4:18 AM: Spy Sweeper 5.3.1.2344 started 4:18 AM: Spy Sweeper 5.3.1.2344 started 4:18 AM: | Start of Session, Saturday, February 24, 2007 | *************** 11:14 AM: ApplicationMinimized - EXIT 11:14 AM: ApplicationMinimized - ENTER 11:14 AM: None 11:14 AM: Traces Found: 0 11:14 AM: Context File Sweep has completed. Elapsed time 00:00:00 11:14 AM: File Sweep Complete, Elapsed Time: 00:00:00 11:14 AM: Starting File Sweep 11:14 AM: Start Context File Sweep 11:14 AM: Sweep initiated using definitions version 866 11:11 AM: ApplicationMinimized - EXIT 11:11 AM: ApplicationMinimized - ENTER 11:11 AM: None 11:11 AM: Traces Found: 0 11:11 AM: Context File Sweep has completed. Elapsed time 00:00:00 11:11 AM: File Sweep Complete, Elapsed Time: 00:00:00 11:11 AM: Starting File Sweep 11:11 AM: Start Context File Sweep 11:11 AM: Sweep initiated using definitions version 866 11:11 AM: ApplicationMinimized - EXIT 11:11 AM: ApplicationMinimized - ENTER 11:04 AM: ApplicationMinimized - EXIT 11:04 AM: ApplicationMinimized - ENTER 11:03 AM: ApplicationMinimized - EXIT 11:03 AM: ApplicationMinimized - EXIT 11:03 AM: ApplicationMinimized - ENTER 11:03 AM: ApplicationMinimized - ENTER 10:59 AM: ApplicationMinimized - EXIT 10:59 AM: ApplicationMinimized - EXIT 10:59 AM: ApplicationMinimized - ENTER 10:59 AM: ApplicationMinimized - ENTER 10:59 AM: None 10:59 AM: Traces Found: 0 10:59 AM: Context File Sweep has completed. Elapsed time 00:00:01 10:59 AM: File Sweep Complete, Elapsed Time: 00:00:00 10:59 AM: Starting File Sweep 10:59 AM: Start Context File Sweep 10:59 AM: Sweep initiated using definitions version 866 9:17 AM: ApplicationMinimized - EXIT 9:17 AM: ApplicationMinimized - ENTER 9:12 AM: None 9:12 AM: Traces Found: 0 9:12 AM: Custom Sweep has completed. Elapsed time 00:05:37 9:12 AM: File Sweep Complete, Elapsed Time: 00:05:35 9:12 AM: Warning: Failed to open file "c:\documents and settings\user\application data\mozilla\firefox\profiles\0joooyv3.default\parent.lock". The operation completed successfully 9:10 AM: ApplicationMinimized - EXIT 9:10 AM: ApplicationMinimized - EXIT 9:10 AM: ApplicationMinimized - ENTER 9:10 AM: ApplicationMinimized - ENTER 9:09 AM: ApplicationMinimized - EXIT 9:09 AM: ApplicationMinimized - EXIT 9:09 AM: ApplicationMinimized - ENTER 9:09 AM: ApplicationMinimized - ENTER 9:08 AM: ApplicationMinimized - EXIT 9:08 AM: ApplicationMinimized - EXIT 9:08 AM: ApplicationMinimized - ENTER 9:08 AM: ApplicationMinimized - ENTER 9:08 AM: ApplicationMinimized - EXIT 9:08 AM: ApplicationMinimized - EXIT 9:08 AM: ApplicationMinimized - ENTER 9:08 AM: ApplicationMinimized - ENTER 9:07 AM: ApplicationMinimized - EXIT 9:07 AM: ApplicationMinimized - EXIT 9:07 AM: ApplicationMinimized - ENTER 9:07 AM: ApplicationMinimized - ENTER 9:07 AM: Starting File Sweep 9:07 AM: Start Custom Sweep 9:07 AM: Sweep initiated using definitions version 866 9:03 AM: None 9:03 AM: Traces Found: 0 9:03 AM: Custom Sweep has completed. Elapsed time 00:18:20 9:03 AM: File Sweep Complete, Elapsed Time: 01:08:24 9:02 AM: ApplicationMinimized - EXIT 9:02 AM: ApplicationMinimized - EXIT 9:02 AM: ApplicationMinimized - ENTER 9:02 AM: ApplicationMinimized - ENTER 9:00 AM: ApplicationMinimized - EXIT 9:00 AM: ApplicationMinimized - EXIT 9:00 AM: ApplicationMinimized - ENTER 9:00 AM: ApplicationMinimized - ENTER 8:59 AM: ApplicationMinimized - EXIT 8:59 AM: ApplicationMinimized - EXIT 8:59 AM: ApplicationMinimized - ENTER 8:59 AM: ApplicationMinimized - ENTER 8:58 AM: Warning: Failed to open file "c:\system volume information\catalog.wci\ciflfffc.000". The operation completed successfully 8:58 AM: ApplicationMinimized - EXIT 8:58 AM: ApplicationMinimized - EXIT 8:58 AM: ApplicationMinimized - ENTER 8:58 AM: ApplicationMinimized - ENTER 8:55 AM: ApplicationMinimized - EXIT 8:55 AM: ApplicationMinimized - EXIT 8:55 AM: ApplicationMinimized - ENTER 8:55 AM: ApplicationMinimized - ENTER 8:49 AM: ApplicationMinimized - EXIT 8:49 AM: ApplicationMinimized - EXIT 8:49 AM: ApplicationMinimized - ENTER 8:49 AM: ApplicationMinimized - ENTER 8:47 AM: ApplicationMinimized - EXIT 8:47 AM: ApplicationMinimized - EXIT 8:47 AM: ApplicationMinimized - ENTER 8:47 AM: ApplicationMinimized - ENTER 8:46 AM: ApplicationMinimized - EXIT 8:46 AM: ApplicationMinimized - EXIT 8:46 AM: ApplicationMinimized - ENTER 8:46 AM: ApplicationMinimized - ENTER 8:40 AM: Messenger service has been disabled. 8:37 AM: Messenger service has been disabled. 8:21 AM: ApplicationMinimized - EXIT 8:21 AM: ApplicationMinimized - EXIT 8:21 AM: ApplicationMinimized - ENTER 8:21 AM: ApplicationMinimized - ENTER 8:11 AM: ApplicationMinimized - EXIT 8:11 AM: ApplicationMinimized - EXIT 8:11 AM: ApplicationMinimized - ENTER 8:11 AM: ApplicationMinimized - ENTER 8:07 AM: ApplicationMinimized - EXIT 8:07 AM: ApplicationMinimized - EXIT 8:07 AM: ApplicationMinimized - ENTER 8:07 AM: ApplicationMinimized - ENTER 8:07 AM: ApplicationMinimized - EXIT 8:07 AM: ApplicationMinimized - EXIT 8:07 AM: ApplicationMinimized - ENTER 8:07 AM: ApplicationMinimized - ENTER 8:02 AM: ApplicationMinimized - EXIT 8:02 AM: ApplicationMinimized - ENTER 8:02 AM: ApplicationMinimized - EXIT 8:02 AM: ApplicationMinimized - ENTER 8:02 AM: ApplicationMinimized - EXIT 8:02 AM: ApplicationMinimized - ENTER 8:01 AM: ApplicationMinimized - EXIT 8:01 AM: ApplicationMinimized - EXIT 8:01 AM: ApplicationMinimized - ENTER 8:01 AM: ApplicationMinimized - ENTER 8:00 AM: ApplicationMinimized - EXIT 8:00 AM: ApplicationMinimized - EXIT 8:00 AM: ApplicationMinimized - ENTER 8:00 AM: ApplicationMinimized - ENTER 7:59 AM: ApplicationMinimized - EXIT 7:59 AM: ApplicationMinimized - EXIT 7:59 AM: ApplicationMinimized - ENTER 7:59 AM: ApplicationMinimized - ENTER 7:57 AM: ApplicationMinimized - EXIT 7:57 AM: ApplicationMinimized - EXIT 7:57 AM: ApplicationMinimized - ENTER 7:57 AM: ApplicationMinimized - ENTER 7:55 AM: ApplicationMinimized - EXIT 7:55 AM: ApplicationMinimized - EXIT 7:55 AM: ApplicationMinimized - ENTER 7:55 AM: ApplicationMinimized - ENTER 7:54 AM: Starting File Sweep 7:54 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00 7:54 AM: Starting Cookie Sweep 7:54 AM: Registry Sweep Complete, Elapsed Time:00:00:21 7:54 AM: Starting Registry Sweep 7:54 AM: Memory Sweep Complete, Elapsed Time: 00:01:16 7:54 AM: ApplicationMinimized - EXIT 7:54 AM: ApplicationMinimized - EXIT 7:54 AM: ApplicationMinimized - ENTER 7:54 AM: ApplicationMinimized - ENTER 7:53 AM: ApplicationMinimized - EXIT 7:53 AM: ApplicationMinimized - EXIT 7:53 AM: ApplicationMinimized - ENTER 7:53 AM: ApplicationMinimized - ENTER 7:52 AM: Starting Memory Sweep 7:52 AM: Start Custom Sweep 7:52 AM: Sweep initiated using definitions version 866 7:50 AM: Your definitions are up to date. 7:38 AM: IE Hijack Shield: Blacklisted change blocked. 7:38 AM: IE Hijack Shield: Blacklisted change blocked. 7:38 AM: IE Hijack Shield: Blacklisted change blocked. 7:33 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later. 7:33 AM: ApplicationMinimized - EXIT 7:33 AM: ApplicationMinimized - ENTER 7:32 AM: ApplicationMinimized - EXIT 7:32 AM: ApplicationMinimized - EXIT 7:32 AM: ApplicationMinimized - ENTER 7:32 AM: ApplicationMinimized - ENTER 7:32 AM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later. Operation: File Access Target: Source: C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE 7:31 AM: Tamper Detection Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 7:30 AM: Shield States 7:30 AM: Spyware Definitions: 866 7:30 AM: Spy Sweeper 5.3.1.2344 started 7:30 AM: Spy Sweeper 5.3.1.2344 started 7:30 AM: | Start of Session, Saturday, February 24, 2007 | *************** Operation: Terminate Target: C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe Source: C:\WINDOWS\system32\csrss.exe 9:32 PM: Tamper Detection Operation: Terminate Target: C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe Source: C:\WINDOWS\system32\csrss.exe 9:32 PM: Tamper Detection Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 9:27 PM: Shield States 9:27 PM: Spyware Definitions: 865 9:27 PM: Spy Sweeper 5.3.1.2344 started 9:27 PM: Spy Sweeper 5.3.1.2344 started 9:27 PM: | Start of Session, Friday, February 23, 2007 | *************** 10:20 PM: ApplicationMinimized - EXIT 10:20 PM: ApplicationMinimized - ENTER 10:20 PM: ApplicationMinimized - EXIT 10:20 PM: ApplicationMinimized - ENTER 10:16 PM: None 10:16 PM: Traces Found: 0 10:16 PM: Custom Sweep has completed. Elapsed time 00:28:55 10:16 PM: File Sweep Complete, Elapsed Time: 00:27:47 10:10 PM: Warning: Failed to open file "c:\system volume information\catalog.wci\ciflfffc.000". The operation completed successfully 9:48 PM: Starting File Sweep 9:48 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 9:48 PM: Starting Cookie Sweep 9:48 PM: Registry Sweep Complete, Elapsed Time:00:00:11 9:48 PM: Starting Registry Sweep 9:48 PM: Memory Sweep Complete, Elapsed Time: 00:00:50 9:47 PM: Starting Memory Sweep 9:47 PM: Start Custom Sweep 9:47 PM: Sweep initiated using definitions version 865 9:43 PM: None 9:43 PM: Traces Found: 0 9:43 PM: Quick Sweep has completed. Elapsed time 00:03:38 9:43 PM: File Sweep Complete, Elapsed Time: 00:00:31 9:43 PM: Warning: SweepDirectories: This instance of TCustomFileEnumerator can only handle files and directories located on drive "T:" but not drive "C:" 9:43 PM: Warning: SweepDirectories: This instance of TCustomFileEnumerator can only handle files and directories located on drive "T:" but not drive "C:" 9:43 PM: Starting File Sweep 9:42 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 9:42 PM: Starting Cookie Sweep 9:42 PM: Registry Sweep Complete, Elapsed Time:00:00:11 9:42 PM: Starting Registry Sweep 9:42 PM: Memory Sweep Complete, Elapsed Time: 00:02:43 9:40 PM: Starting Memory Sweep 9:39 PM: Start Quick Sweep 9:39 PM: Sweep initiated using definitions version 865 9:39 PM: Hosts File Shield: On 9:39 PM: Hosts File Shield: Off Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 9:37 PM: Shield States 9:37 PM: Spyware Definitions: 865 9:37 PM: Spy Sweeper 5.3.1.2344 started 9:37 PM: Spy Sweeper 5.3.1.2344 started 9:37 PM: | Start of Session, Friday, February 23, 2007 | *************** 12:37 AM: ApplicationMinimized - EXIT 12:37 AM: ApplicationMinimized - ENTER 12:36 AM: Your definitions are up to date. 12:36 AM: None 12:36 AM: Traces Found: 0 12:36 AM: Context File Sweep has completed. Elapsed time 00:00:01 12:36 AM: File Sweep Complete, Elapsed Time: 00:00:00 12:36 AM: Starting File Sweep 12:36 AM: Start Context File Sweep 12:36 AM: Sweep initiated using definitions version 866 11:40 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:34 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:34 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:34 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:34 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:34 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:34 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:33 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:33 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:33 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:33 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:32 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:32 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:31 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:30 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:30 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:30 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 11:30 PM: IE Tracking Cookies Shield: Removed qksrv cookie 11:30 PM: IE Tracking Cookies Shield: Removed apmebf cookie 11:29 PM: ApplicationMinimized - EXIT 11:29 PM: ApplicationMinimized - ENTER 10:52 PM: ApplicationMinimized - EXIT 10:52 PM: ApplicationMinimized - ENTER 10:51 PM: Your definitions are up to date. 10:51 PM: Your definitions are up to date. 10:50 PM: Your spyware definitions have been updated. Operation: File Access Target: Source: C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE 10:50 PM: Tamper Detection 10:49 PM: Automated check for program update in progress. Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 10:49 PM: Shield States 10:49 PM: Spyware Definitions: 865 10:48 PM: Spy Sweeper 5.3.1.2344 started 10:48 PM: Spy Sweeper 5.3.1.2344 started 10:48 PM: | Start of Session, Friday, February 23, 2007 | *************** 9:20 PM: | End of Session, Thursday, February 22, 2007 | 9:20 PM: Your spyware definitions have been updated. 9:16 PM: Messenger service has been disabled. Keylogger Shield: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites Shield: Off Hosts File Shield: On Spy Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: Off 9:16 PM: Shield States 9:16 PM: Spyware Definitions: 691 9:15 PM: Spy Sweeper 5.0.5.1286 started 9:03 PM: | End of Session, Thursday, February 22, 2007 | 9:03 PM: Program Version 5.0.5.1286 Using Spyware Definitions 691 9:03 PM: Spy Sweeper 5.0.5.1286 started 9:03 PM: | Start of Session, Thursday, February 22, 2007 | ******** 9:14 PM: Traces Found: 0 9:14 PM: Full Sweep has completed. Elapsed time 00:11:07 9:14 PM: File Sweep Complete, Elapsed Time: 00:10:00 9:04 PM: Starting File Sweep 9:04 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 9:04 PM: Starting Cookie Sweep 9:04 PM: Registry Sweep Complete, Elapsed Time:00:00:18 9:04 PM: Starting Registry Sweep 9:04 PM: Memory Sweep Complete, Elapsed Time: 00:00:37 9:03 PM: Starting Memory Sweep 9:03 PM: Sweep initiated using definitions version 691 9:03 PM: Spy Sweeper 5.0.5.1286 started 9:03 PM: | Start of Session, Thursday, February 22, 2007 | ******** Operation: File Access Target: Source: C:\DOCUME~1\USER\LOCALS~1\TEMP\IS-24N0J.TMP\IS-IFB4K.TMP 9:46 PM: Tamper Detection 9:40 PM: IE Tracking Cookies Shield: On 9:38 PM: None 9:38 PM: Traces Found: 0 9:38 PM: Full Sweep has completed. Elapsed time 00:18:13 9:38 PM: File Sweep Complete, Elapsed Time: 00:15:03 9:23 PM: Starting File Sweep 9:23 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 9:23 PM: Starting Cookie Sweep 9:23 PM: Registry Sweep Complete, Elapsed Time:00:00:22 Operation: File Access Target: Source: C:\WINDOWS\SYSTEM32\CIDAEMON.EXE 9:23 PM: Tamper Detection 9:23 PM: Starting Registry Sweep 9:23 PM: Memory Sweep Complete, Elapsed Time: 00:02:42 9:20 PM: Starting Memory Sweep 9:20 PM: Sweep initiated using definitions version 865 9:20 PM: Spy Sweeper 5.0.5.1286 started 9:20 PM: | Start of Session, Thursday, February 22, 2007 | ******** 10:33 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:31 PM: ApplicationMinimized - EXIT 10:31 PM: ApplicationMinimized - ENTER 10:31 PM: Spy Installation Shield: found: Adware: 180search assistant/zango, version 1.0.0.0 10:31 PM: Spy Installation Shield: found: Adware: 180search assistant/zango, version 1.0.0.0 10:31 PM: Spy Installation Shield: found: Adware: 180search assistant/zango, version 1.0.0.0 10:31 PM: ApplicationMinimized - EXIT 10:31 PM: ApplicationMinimized - ENTER 10:31 PM: Spy Installation Shield: found: Adware: 180search assistant/zango, version 1.0.0.0 10:31 PM: ApplicationMinimized - EXIT 10:31 PM: ApplicationMinimized - ENTER 10:31 PM: Spy Installation Shield: found: Adware: 180search assistant/zango, version 1.0.0.0 10:27 PM: IE Tracking Cookies Shield: Removed atlas dmt cookie 10:26 PM: IE Tracking Cookies Shield: Removed atlas dmt cookie 10:26 PM: IE Tracking Cookies Shield: Removed atlas dmt cookie 10:23 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:22 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:22 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:22 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:14 PM: IE Tracking Cookies Shield: Removed serving-sys cookie 10:14 PM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 10:14 PM: IE Tracking Cookies Shield: Removed serving-sys cookie 10:14 PM: Warning: Unable to remove cookie c:\documents and settings\user\cookies\user@serving-sys[1].txt 10:14 PM: IE Tracking Cookies Shield: Removed serving-sys cookie 10:14 PM: Warning: Unable to remove cookie c:\documents and settings\user\cookies\user@serving-sys[1].txt 10:14 PM: IE Tracking Cookies Shield: Removed serving-sys cookie 10:14 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:14 PM: IE Tracking Cookies Shield: Removed serving-sys cookie 10:13 PM: Warning: Unable to remove cookie c:\documents and settings\user\cookies\user@serving-sys[1].txt 10:13 PM: IE Tracking Cookies Shield: Removed serving-sys cookie 10:13 PM: Warning: Unable to remove cookie c:\documents and settings\user\cookies\user@serving-sys[1].txt 10:13 PM: IE Tracking Cookies Shield: Removed serving-sys cookie 10:13 PM: Warning: Unable to remove cookie c:\documents and settings\user\cookies\[removed]-sys[1].txt 10:13 PM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 10:13 PM: Warning: Unable to remove cookie c:\documents and settings\user\cookies\[removed]-sys[1].txt 10:13 PM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 10:13 PM: IE Tracking Cookies Shield: Removed serving-sys cookie 10:13 PM: IE Tracking Cookies Shield: Removed bs.serving-sys cookie 10:13 PM: IE Tracking Cookies Shield: Removed sympaticoca cookie 10:13 PM: IE Tracking Cookies Shield: Removed sympaticoca cookie 10:12 PM: IE Tracking Cookies Shield: Removed sympaticoca cookie 10:12 PM: IE Tracking Cookies Shield: Removed sympaticoca cookie 10:12 PM: IE Tracking Cookies Shield: Removed sympaticoca cookie 10:12 PM: IE Tracking Cookies Shield: Removed sympaticoca cookie 10:10 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:04 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:04 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 9:57 PM: ApplicationMinimized - EXIT 9:57 PM: ApplicationMinimized - ENTER 9:57 PM: None 9:57 PM: Traces Found: 0 9:57 PM: Quick Sweep has completed. Elapsed time 00:02:53 9:57 PM: File Sweep Complete, Elapsed Time: 00:00:34 9:57 PM: Warning: SweepDirectories: This instance of TCustomFileEnumerator can only handle files and directories located on drive "T:" but not drive "C:" 9:57 PM: Warning: SweepDirectories: This instance of TCustomFileEnumerator can only handle files and directories located on drive "T:" but not drive "C:" 9:56 PM: Starting File Sweep 9:56 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 9:56 PM: Starting Cookie Sweep 9:56 PM: Registry Sweep Complete, Elapsed Time:00:00:14 9:56 PM: Starting Registry Sweep 9:56 PM: Memory Sweep Complete, Elapsed Time: 00:01:52 9:54 PM: Starting Memory Sweep 9:54 PM: Start Quick Sweep 9:54 PM: Sweep initiated using definitions version 865 9:53 PM: Your definitions are up to date. Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 9:52 PM: Shield States 9:52 PM: Spyware Definitions: 865 9:51 PM: Spy Sweeper 5.3.1.2344 started 9:51 PM: Spy Sweeper 5.3.1.2344 started 9:51 PM: | Start of Session, Thursday, February 22, 2007 | *************** 10:52 PM: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST324.tmp.LOG". Reason: The process cannot access the file because it is being used by another process 10:52 PM: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST324.tmp". Reason: The process cannot access the file because it is being used by another process 10:52 PM: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST324.tmp.log". Reason: The process cannot access the file because it is being used by another process 10:52 PM: Warning: S-1-5-21-3805796006-14762468-2840279162-500 could not be unmapped. Error Code 5 10:50 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie 10:48 PM: IE Tracking Cookies Shield: Removed 2o7.net cookie Keylogger: On BHO Shield: On IE Security Shield: On Alternate Data Stream (ADS) Execution Shield: On Startup Shield: On Common Ad Sites: Off Hosts File Shield: On Internet Communication Shield: Off ActiveX Shield: On Windows Messenger Service Shield: On IE Favorites Shield: On Spy Installation Shield: On Memory Shield: On IE Hijack Shield: On IE Tracking Cookies Shield: On 10:43 PM: Shield States 10:43 PM: Spyware Definitions: 865 10:42 PM: Spy Sweeper 5.3.1.2344 started 10:42 PM: Spy Sweeper 5.3.1.2344 started 10:42 PM: | Start of Session, Thursday, February 22, 2007 | *************** Did a firewall test via Hacker Watch…… all ports tested secured. Via PC Flanks Advanced port scan…. 135 closed RPC Remote Procedure Call (RPC) is used in client/server applications based on MS Windows operating systems 1080 closed SOCKS PROXY Socks Proxy is an internet proxy service FYI…. under Windows Firewall, which is ON, under the exceptions tab, I unchecked Remote Assistance and Remote Desktop. As this will block incoming network connection. Also under the Advanced tab…. ICMP Settings I can not for the life of me uncheck " Allow Incoming Echo Request " Should I be concerned with either? THANK YOU !!! Oh Goodie…. more logs to follow.