Spyware / Malware / Virus Removal

Hijack This Log

15 min read

Looking for the outcome? Ask AI

drizzamed Topic Starter

Post #1March 24, 2007, 3:51 PM UTC

Here is my log. I have recently began getting pop ups for antivirus programs.. Such as Avaena(?)
I did not download anything, I just closed the window. Here is my log. Please Help.

Logfile of HijackThis v1.99.1
Scan saved at 10:32:55 AM, on 3/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Trend Micro\Tmasy\Tmasy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\MP3, Website & Backup, My Briefcase\My Briefcase\Program Setups\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SysService] C:\Program Files\XP Keylogger\SERVICES.EXE
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [chcynshdhw] c:\windows\system32\chcynshdhw.exe chcynshdhw
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 2.1.lnk = Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmasy\Tmasy.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {050A0128-BE56-4F4B-9F2A-2F926AB5A2F2} (Pvapplite_ie Control) - https://ondemand.ptc.com/Windchill/wtcore/j…vapplite_ie.cab
O16 - DPF: {0F7A9297-7268-11D1-B81A-00A076C01B0A} - http://www.cartesianinc.com/Products/CPCVi…k/CpcViewAX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1140064843828
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://hq-sabaweb1.ptc.com/viewer/activeXV…tivexviewer.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ptcsupport.webex.com/client/v_myweb…ort/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Thanks!
Robert

LDTate

Post #2March 24, 2007, 4:24 PM UTC

Only for Windows XP and Windows 2000

Hello and welcome to the Forums.

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Double Click SmitfraudFix.exe on your Desktop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

______________________________
Next:

Download AVG Anti-Spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

Once you have downloaded ewido anti-spyware, locate the icon on the desktop
and double-click it to launch the set up program.
Once the setup is complete you will need run AVG Anti-Spyware and update the definition
files.
On the main screen select the icon "Update" then select the "
Update now" link.
- Next select the "Start Update" button, the update will start and a
  progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then
select "Delete".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. It will create a file named:
c:\rapport.txt

IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Please post:
C:\rapport.txt

drizzamed

Post #3March 24, 2007, 7:00 PM UTC

SmitFraudFix v2.154 Scan done at 13:54:11.85, Sat 03/24/2007 Run from C:\WINDOWS\system32\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\administrator.REXSYSTEMS »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\administrator.REXSYSTEMS\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~2.REX\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" "AltDefaultDomainName"="REXSYSTEMS" "DefaultDomainName"="REXSYSTEMS" "CachePrimaryDomain"="REXSYSTEMS" "REXSYSTEMS"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Steps followed as told!

LDTate

Post #4March 24, 2007, 7:04 PM UTC

Nothing there.

Reboot your computer into SafeMode. You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.

Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
ewido will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all
actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
results of the AVG Anti-Spyware report scan along with a new HijackThis log.

drizzamed

Post #5March 24, 2007, 7:43 PM UTC

Here is AVG Log..

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 2:30:10 PM 3/24/2007

+ Scan result:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 -> Adware.Generic : Cleaned.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 -> Adware.Generic : Cleaned.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On -> Adware.IntCodec : Cleaned.
C:\Documents and Settings\veachrr\SmitfraudFix\SmiUpdate.exe -> Adware.SmiUpdate : Cleaned.
C:\WINDOWS\system32\SmitfraudFix\SmiUpdate.exe -> Adware.SmiUpdate : Cleaned.
C:\WINDOWS\system32\drivers\SISAGP2k.sys -> Not-A-Virus.Monitor.Win32.EliteKeylogger.30 : Error during cleaning.
C:\WINDOWS\system32\drivers\drmknt.sys -> Not-A-Virus.Monitor.Win32.EliteKeylogger.30 : Error during cleaning.
C:\WINDOWS\system32\drivers\rdpex.sys -> Not-A-Virus.Monitor.Win32.EliteKeylogger.30 : Error during cleaning.
C:\WINDOWS\system32\nsq1A7.tmp -> Not-A-Virus.Monitor.Win32.EliteKeylogger.30 : Cleaned.
C:\WINDOWS\system32\qdv32.dll -> Not-A-Virus.Monitor.Win32.EliteKeylogger.30 : Cleaned.
C:\WINDOWS\system32\dmremsvr.exe -> Not-A-Virus.Monitor.Win32.EliteKeylogger.3019 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@blockbuster.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@boostmobile.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@buycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@charmingshoppes.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@dupont.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@gettyimages.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@giftscom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@goodyear.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@gourmetgiftbaskets.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@jewelrytelevision.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@l-com.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@leeenterprises.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@livemercial.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@livenation.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@lonelyplanet.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@marketworksinc.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@metacafe.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@netgear.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@northwestairlines.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@potpourrigroup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@primediabusiness.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@vitacost.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@whitecastle.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@2o7[3].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@blockbuster.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@celebrateexpress.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@flukecorporation.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.6:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.7:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Adobe : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@adrevolver[5].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@advertising[3].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@advertising[4].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@advertising[5].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][3].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@casalemedia[3].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@casalemedia[4].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@centrport[1].txt -> TrackingCookie.Centrport : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Cnn : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@dealtime[2].txt -> TrackingCookie.Dealtime : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Dealtime : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@fastclick[3].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@fortunecity[2].txt -> TrackingCookie.Fortunecity : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@hotlog[2].txt -> TrackingCookie.Hotlog : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@hotlog[1].txt -> TrackingCookie.Hotlog : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@overture[2].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Paypal : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][3].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][4].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@pro-market[1].txt -> TrackingCookie.Pro-market : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@qksrv[1].txt -> TrackingCookie.Qksrv : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@questionmarket[3].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@questionmarket[4].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.32:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.33:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@realmedia[2].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@realmedia[3].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@realmedia[4].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@realmedia[5].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Realtracker : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@revenue[2].txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@revsci[1].txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed]-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.34:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.35:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@tacoda[3].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@toplist[1].txt -> TrackingCookie.Toplist : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned.
:mozilla.36:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.37:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.38:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.39:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.40:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.41:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.42:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@trafficmp[4].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@trafic[1].txt -> TrackingCookie.Trafic : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@webstat[1].txt -> TrackingCookie.Web-stat : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.46:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.47:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.48:C:\Documents and Settings\veachrr\Application Data\Mozilla\Firefox\Profiles\1ygm7d7w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\veachrr\Cookies\rveach@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\veachrr\Cookies\[removed][3].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\veachrr\Cookies\veachrr@zedo[3].txt -> TrackingCookie.Zedo : Cleaned.

::Report end

Here is the new hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 2:36:25 PM, on 3/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\MP3, Website & Backup, My Briefcase\My Briefcase\Program Setups\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SysService] C:\Program Files\XP Keylogger\SERVICES.EXE
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [chcynshdhw] c:\windows\system32\chcynshdhw.exe chcynshdhw
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 2.1.lnk = Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {050A0128-BE56-4F4B-9F2A-2F926AB5A2F2} (Pvapplite_ie Control) - https://ondemand.ptc.com/Windchill/wtcore/j…vapplite_ie.cab
O16 - DPF: {0F7A9297-7268-11D1-B81A-00A076C01B0A} - http://www.cartesianinc.com/Products/CPCVi…k/CpcViewAX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1140064843828
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://hq-sabaweb1.ptc.com/viewer/activeXV…tivexviewer.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ptcsupport.webex.com/client/v_myweb…ort/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

LDTate

Post #6March 24, 2007, 7:46 PM UTC

How's it running now?

drizzamed

Post #7March 24, 2007, 7:50 PM UTC

As I was reading what you just said.. A popup window came up.. for smitfraud, we/I wasnt suppose to use it to delete anything right? just a scan?

LDTate

Post #8March 24, 2007, 8:01 PM UTC

We ran the smitfraud scan but nothing showed.

Do this:

Download ComboFix from Here or Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

drizzamed

Post #9March 24, 2007, 8:11 PM UTC

Here is the hijack log file….

I ran the combofix, however, when I ran it, it didn't prompt me to do anything… it ran itself. I don't know where the log would have been saved if generated.

As I typed this up, I got the stupid popup window again. It's Avaena trying to get me to download the antivirus carp**.

Logfile of HijackThis v1.99.1
Scan saved at 3:05:08 PM, on 3/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\MP3, Website & Backup, My Briefcase\My Briefcase\Program Setups\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SysService] C:\Program Files\XP Keylogger\SERVICES.EXE
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [chcynshdhw] c:\windows\system32\chcynshdhw.exe chcynshdhw
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 2.1.lnk = Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {050A0128-BE56-4F4B-9F2A-2F926AB5A2F2} (Pvapplite_ie Control) - https://ondemand.ptc.com/Windchill/wtcore/j…vapplite_ie.cab
O16 - DPF: {0F7A9297-7268-11D1-B81A-00A076C01B0A} - http://www.cartesianinc.com/Products/CPCVi…k/CpcViewAX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1140064843828
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://hq-sabaweb1.ptc.com/viewer/activeXV…tivexviewer.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ptcsupport.webex.com/client/v_myweb…ort/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

LDTate

Post #10March 24, 2007, 8:29 PM UTC

When combofix finished it should have rebooted your system and after windows started it would have run and generated a log. Try it again please.

LDTate

Post #11March 31, 2007, 11:07 AM UTC

How are you doing with the fix?

drizzamed

Post #12March 31, 2007, 2:17 PM UTC last edited March 31, 2007, 2:18 PM UTC

I still have the popup windows.. it only happens when I have a browser open.. doesnt matter whether it's firefox or IE. Would roaming profiles be a problem in this situation? I use this laptop at work and log into our domain.. and when I brng it home, it will just load my cached profile. As long as I log in as administrator on the local machine, any changes I make should still take… I think it's amaena adware… majority of the popups are for winantiviruspro2006.. and a few dating advertisements.. PS.. I got the full version of AVG Antispyware now a well.

LDTate

Post #13March 31, 2007, 2:35 PM UTC

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

You should find C:\combofix.txt
Please open it with notepad and post the contents.

drizzamed

Post #14March 31, 2007, 3:03 PM UTC

Here is the ComboFix log.. it worked fine logged in locally as administrator…

"Administrator" - 07-03-31 9:41:22 Service Pack 2
ComboFix 07-03-27.4.2 - Running from: "C:\Documents and Settings\Administrator"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\chcynshdhw_navps.dat
C:\WINDOWS\system32\chcynshdhw.exe
C:\WINDOWS\system32\chcynshdhw.dat

((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-31 ))))))))))))))))))))))))))))))))))

2007-03-30 14:48 d——– C:\DOCUME~1\ADMINI~2.REX\tcm
2007-03-30 14:48 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Webshots
2007-03-30 14:48 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Talkback
2007-03-30 10:26 d——– C:\DOCUME~1\veachrr\APPLIC~1\VMware
2007-03-30 10:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\VMware
2007-03-30 10:25 d——– C:\Program Files\VMware
2007-03-28 08:58 86,016 –a—— C:\WINDOWS\unvise32.exe
2007-03-28 08:58 d——– C:\Program Files\SWiSHmax
2007-03-28 08:43 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Real
2007-03-26 19:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-03-26 18:16 d–h—– C:\WINDOWS\msdownld.tmp
2007-03-26 18:11 d——– C:\WINDOWS\network diagnostic
2007-03-26 18:07 d——– C:\e7fdbb1174e805175122072647794b70
2007-03-24 13:54 d——– C:\WINDOWS\system32\SmitfraudFix
2007-03-24 12:54 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-24 12:54 d——– C:\Program Files\AVG Anti-Spyware
2007-03-24 12:53 d——– C:\DOCUME~1\ADMINI~2.REX\UserData
2007-03-24 11:41 d——– C:\DOCUME~1\ADMINI~2.REX\SmitfraudFix
2007-03-24 11:40 4,102 –a—— C:\WINDOWS\system32\tmp.reg
2007-03-24 11:36 d——– C:\DOCUME~1\veachrr\SmitfraudFix
2007-03-24 00:33 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\CuteReminderPro
2007-03-23 18:27 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-03-23 18:27 d——– C:\Program Files\Trend Micro
2007-03-22 11:59 d——– C:\Rexford
2007-03-21 15:40 d——– C:\MP3, Website & Backup, My Briefcase
2007-03-14 14:08 5,958 –a—— C:\WINDOWS\system32\dngxjcf.dat
2007-03-14 14:08 313,856 –a—— C:\WINDOWS\system32\dngxjcf.exe
2007-03-14 14:08 240,097 –a—— C:\WINDOWS\system32\dngxjcf_nav.dat
2007-03-14 14:08 1,191 –a—— C:\WINDOWS\system32\dngxjcf_navps.dat
2007-03-14 11:55 327,680 –a—— C:\WINDOWS\system32\psctsnmp.dll
2007-03-14 09:50 d——– C:\DOCUME~1\veachrr\WINDOWS
2007-03-14 09:50 d——– C:\DOCUME~1\veachrr\UserData
2007-03-14 09:36 d——– C:\DOCUME~1\veachrr\APPLIC~1\WeatherBug
2007-03-14 09:35 d——– C:\DOCUME~1\veachrr\APPLIC~1\uTorrent
2007-03-14 09:34 d——– C:\DOCUME~1\veachrr\APPLIC~1\Thunderbird
2007-03-14 09:34 d——– C:\DOCUME~1\veachrr\APPLIC~1\Talkback
2007-03-14 09:34 d——– C:\DOCUME~1\veachrr\APPLIC~1\Sonic
2007-03-14 09:34 d——– C:\DOCUME~1\veachrr\APPLIC~1\shockwave.com
2007-03-14 09:28 d——– C:\DOCUME~1\veachrr\APPLIC~1\McAfee.com Personal Firewall
2007-03-14 09:28 d——– C:\DOCUME~1\veachrr\APPLIC~1\McAfee
2007-03-14 09:27 d——– C:\DOCUME~1\veachrr\APPLIC~1\Leadertech
2007-03-14 09:27 d——– C:\DOCUME~1\veachrr\APPLIC~1\Help
2007-03-14 09:26 d——– C:\DOCUME~1\veachrr\APPLIC~1\CyberLink
2007-03-14 09:26 d——– C:\DOCUME~1\veachrr\APPLIC~1\CuteReminderPro
2007-03-14 09:26 d——– C:\DOCUME~1\veachrr\APPLIC~1\Corel Photo Album
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\Corel
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\Ahead
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\AdobeUM
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\Adobe
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\Acoustica
2007-03-14 09:21 d–h—– C:\DOCUME~1\veachrr\.wt
2007-03-14 09:15 3,145,728 –ah—– C:\DOCUME~1\veachrr\NTUSER.DAT
2007-03-14 09:15 d——– C:\DOCUME~1\veachrr\APPLIC~1\Sun
2007-03-14 09:15 d——– C:\DOCUME~1\veachrr\APPLIC~1\Intel
2007-03-14 09:15 d——– C:\DOCUME~1\veachrr\APPLIC~1\Gtek
2007-03-14 09:15 d——– C:\DOCUME~1\veachrr\APPLIC~1\Google
2007-03-13 16:00 2,621,440 –a—— C:\DOCUME~1\ADMINI~2.REX\NTUSER.DAT
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\WINDOWS
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Thunderbird
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\OpenOffice.org2
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Intel
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Adobe
2007-03-13 15:54 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-03-12 19:20 d——– C:\Program Files\InternetGameBox
2007-03-10 18:23 d——– C:\Program Files\Virtools
2007-03-05 10:28 d——– C:\Program Files\TightVNC
2007-03-05 09:33 925,795 –a—— C:\WINDOWS\system32\RC8FE140.DLL
2007-03-05 09:33 77,824 –a—— C:\WINDOWS\system32\Rc4manNT.dll
2007-03-05 09:33 73,728 –a—— C:\WINDOWS\system32\RCPRINT.dll
2007-03-05 09:33 69,632 –a—— C:\WINDOWS\system32\TIFmtA.dll
2007-03-05 09:33 61,440 –a—— C:\WINDOWS\system32\TrackID.dll
2007-03-05 09:33 57,344 –a—— C:\WINDOWS\system32\rdrvinf.dll
2007-03-05 09:33 54,784 –a—— C:\WINDOWS\system32\rdrvlog.dll
2007-03-05 09:33 53,248 –a—— C:\WINDOWS\system32\RICDB32.dll
2007-03-05 09:33 49,152 –a—— C:\WINDOWS\system32\TIBase64.dll
2007-03-05 09:33 37,376 –a—— C:\WINDOWS\system32\MFRICRES.dll
2007-03-05 09:33 32,768 –a—— C:\WINDOWS\system32\RC00C140.dll
2007-03-05 09:33 30,720 –a—— C:\WINDOWS\system32\RC00C150.dll
2007-03-05 09:33 27,136 –a—— C:\WINDOWS\system32\RCINST.dll
2007-03-05 09:33 236,024 –a—— C:\WINDOWS\system32\rpcsecl.dll
2007-03-05 09:33 217,088 –a—— C:\WINDOWS\system32\RICJC32.dll
2007-03-05 09:33 167,936 –a—— C:\WINDOWS\system32\JCUI.exe
2007-03-05 09:33 1,126,400 –a—— C:\WINDOWS\system32\Ne35Cdat.dll
2007-03-05 09:33 d–h—– C:\_rpcs

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-03-31 09:18 ——– d——– C:\Program Files\mozilla thunderbird
2007-03-31 09:07 ——– d——– C:\Program Files\cutereminderpro
2007-03-28 15:16 6380 –a—— C:\WINDOWS\mozver.dat
2007-03-26 18:17 ——– d——– C:\Program Files\yahoo!
2007-03-24 14:05 ——– d——– C:\Program Files\intel
2007-03-19 18:05 ——– d——– C:\Program Files\trillian
2007-02-22 13:10 ——– d——– C:\Program Files\java
2007-02-20 19:53 ——– d–h—– C:\Program Files\installshield installation information
2007-02-20 16:26 ——– d——– C:\Program Files\sftpdrive
2007-02-10 16:33 ——– d——– C:\Program Files\google
2007-01-08 19:01 17408 –a—— C:\WINDOWS\system32\corpol.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
@=""
"IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"MSKDetectorExe"="C:\\Program Files\\McAfee\\SpamKiller\\MSKDetct.exe /uninstall"
"avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"SysService"="C:\\Program Files\\XP Keylogger\\SERVICES.EXE"
"LexStart"="lexstart.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SysService"="C:\\Program Files\\XP Keylogger\\SERVICES.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (ROBERT-Veach).job

********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes …

scanning hidden services …

HKLM\SYSTEM\CurrentControlSet\Services\E100Bdm

HKLM\SYSTEM\CurrentControlSet\Services\EvtEngystem

HKLM\SYSTEM\CurrentControlSet\Services\FaxtUserSwitchingCompatibility

HKLM\SYSTEM\CurrentControlSet\Services\FltMgrsk

HKLM\SYSTEM\CurrentControlSet\Services\Gpcisk

HKLM\SYSTEM\CurrentControlSet\Services\HidUsbv

HKLM\SYSTEM\CurrentControlSet\Services\hpnUsb

HKLM\SYSTEM\CurrentControlSet\Services\HSF_DPCH

HKLM\SYSTEM\CurrentControlSet\Services\HTTPDP

HKLM\SYSTEM\CurrentControlSet\Services\i2omgmtter

HKLM\SYSTEM\CurrentControlSet\Services\i2ompmt

HKLM\SYSTEM\CurrentControlSet\Services\ialm2prt

HKLM\SYSTEM\CurrentControlSet\Services\inetaccsvice

HKLM\SYSTEM\CurrentControlSet\Services\ini910us

HKLM\SYSTEM\CurrentControlSet\Services\Inportu

HKLM\SYSTEM\CurrentControlSet\Services\Ip6Fwppm

HKLM\SYSTEM\CurrentControlSet\Services\IpInIperDriver

HKLM\SYSTEM\CurrentControlSet\Services\IpNatp

HKLM\SYSTEM\CurrentControlSet\Services\isapnpearch

HKLM\SYSTEM\CurrentControlSet\Services\IWCAnp

HKLM\SYSTEM\CurrentControlSet\Services\kmixerss

HKLM\SYSTEM\CurrentControlSet\Services\lbrtfdcorkstation

HKLM\SYSTEM\CurrentControlSet\Services\ldapfdc

HKLM\SYSTEM\CurrentControlSet\Services\LmHostsService

HKLM\SYSTEM\CurrentControlSet\Services\MDMosts

HKLM\SYSTEM\CurrentControlSet\Services\mnmddnger

HKLM\SYSTEM\CurrentControlSet\Services\Modemvc

HKLM\SYSTEM\CurrentControlSet\Services\mouhidss

HKLM\SYSTEM\CurrentControlSet\Services\MRxDAV5x

HKLM\SYSTEM\CurrentControlSet\Services\MSDTCb

HKLM\SYSTEM\CurrentControlSet\Services\MsfsC

HKLM\SYSTEM\CurrentControlSet\Services\MSKSSRVer

HKLM\SYSTEM\CurrentControlSet\Services\MSPQMOCK

HKLM\SYSTEM\CurrentControlSet\Services\Mupmbios

HKLM\SYSTEM\CurrentControlSet\Services\Ndisuioi

HKLM\SYSTEM\CurrentControlSet\Services\NetBTOS

HKLM\SYSTEM\CurrentControlSet\Services\Netlogondm

HKLM\SYSTEM\CurrentControlSet\Services\Netmanon

HKLM\SYSTEM\CurrentControlSet\Services\NlaCONFIGSVC

HKLM\SYSTEM\CurrentControlSet\Services\NullSvc

HKLM\SYSTEM\CurrentControlSet\Services\nvll

HKLM\SYSTEM\CurrentControlSet\Services\omci1394

HKLM\SYSTEM\CurrentControlSet\Services\osei

HKLM\SYSTEM\CurrentControlSet\Services\ParVdmr

HKLM\SYSTEM\CurrentControlSet\Services\PCIVdm

HKLM\SYSTEM\CurrentControlSet\Services\PCIIdep

HKLM\SYSTEM\CurrentControlSet\Services\PDRELIE

HKLM\SYSTEM\CurrentControlSet\Services\perc2AME

HKLM\SYSTEM\CurrentControlSet\Services\PerfNetk

HKLM\SYSTEM\CurrentControlSet\Services\PerfOSt

HKLM\SYSTEM\CurrentControlSet\Services\PSchedtedStorage

HKLM\SYSTEM\CurrentControlSet\Services\pxcomnk

HKLM\SYSTEM\CurrentControlSet\Services\ql108020

HKLM\SYSTEM\CurrentControlSet\Services\ql12400

HKLM\SYSTEM\CurrentControlSet\Services\RasManp

HKLM\SYSTEM\CurrentControlSet\Services\Rasptioe

HKLM\SYSTEM\CurrentControlSet\Services\Rdbssi

HKLM\SYSTEM\CurrentControlSet\Services\RDPDDD

HKLM\SYSTEM\CurrentControlSet\Services\RegSrvcgr

HKLM\SYSTEM\CurrentControlSet\Services\RpcLocatorss

HKLM\SYSTEM\CurrentControlSet\Services\RpcSseRegistry

HKLM\SYSTEM\CurrentControlSet\Services\RSVPocator

HKLM\SYSTEM\CurrentControlSet\Services\SamSsentMonitor

HKLM\SYSTEM\CurrentControlSet\Services\sdbusSvr

HKLM\SYSTEM\CurrentControlSet\Services\Secdrvle

HKLM\SYSTEM\CurrentControlSet\Services\SENSrv

HKLM\SYSTEM\CurrentControlSet\Services\serenumn

HKLM\SYSTEM\CurrentControlSet\Services\SimbadAccess

HKLM\SYSTEM\CurrentControlSet\Services\sisagpWDetection

HKLM\SYSTEM\CurrentControlSet\Services\Spooler1

HKLM\SYSTEM\CurrentControlSet\Services\srarrow

HKLM\SYSTEM\CurrentControlSet\Services\Srvoler

HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRVce

HKLM\SYSTEM\CurrentControlSet\Services\STAC97k5

HKLM\SYSTEM\CurrentControlSet\Services\stisvcV

HKLM\SYSTEM\CurrentControlSet\Services\SwPrvc

HKLM\SYSTEM\CurrentControlSet\Services\sym_u30

HKLM\SYSTEM\CurrentControlSet\Services\Tcpipdio

HKLM\SYSTEM\CurrentControlSet\Services\TDPIPELog

HKLM\SYSTEM\CurrentControlSet\Services\TDTCPrv

HKLM\SYSTEM\CurrentControlSet\Services\tfsndrctice

HKLM\SYSTEM\CurrentControlSet\Services\tfsnifss

HKLM\SYSTEM\CurrentControlSet\Services\Themesol

HKLM\SYSTEM\CurrentControlSet\Services\tmcommfa

HKLM\SYSTEM\CurrentControlSet\Services\TrkWksr

HKLM\SYSTEM\CurrentControlSet\Services\TSDDDm

HKLM\SYSTEM\CurrentControlSet\Services\Udfsde

HKLM\SYSTEM\CurrentControlSet\Services\ultras

HKLM\SYSTEM\CurrentControlSet\Services\UPSra

HKLM\SYSTEM\CurrentControlSet\Services\usbehcit

HKLM\SYSTEM\CurrentControlSet\Services\usbseri

HKLM\SYSTEM\CurrentControlSet\Services\usbuhcipt

HKLM\SYSTEM\CurrentControlSet\Services\VgaSaveptxp

HKLM\SYSTEM\CurrentControlSet\Services\viaagpR

HKLM\SYSTEM\CurrentControlSet\Services\ViaIdei

HKLM\SYSTEM\CurrentControlSet\Services\VSSIde

HKLM\SYSTEM\CurrentControlSet\Services\w29n51sb

HKLM\SYSTEM\CurrentControlSet\Services\wanatwe

HKLM\SYSTEM\CurrentControlSet\Services\Winsocknt

HKLM\SYSTEM\CurrentControlSet\Services\WmiTrust

HKLM\SYSTEM\CurrentControlSet\Services\WmiApRplER

HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSLl

HKLM\SYSTEM\CurrentControlSet\Services\wscsvcrv

HKLM\SYSTEM\CurrentControlSet\Services\wuauservrkSvc

HKLM\SYSTEM\CurrentControlSet\Services\WudfPfL

HKLM\SYSTEM\CurrentControlSet\Services\WudfSvcv

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 106
hidden files: 0

********************************************************************

Completion time: 07-03-31 9:51:12

Here is the Hijack log after ComboFix:

Logfile of HijackThis v1.99.1
Scan saved at 9:55:24 AM, on 3/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\MP3, Website & Backup, My Briefcase\My Briefcase\Program Setups\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://downloads.yahoo.com/internetexplorer/welcome.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SysService] C:\Program Files\XP Keylogger\SERVICES.EXE
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {050A0128-BE56-4F4B-9F2A-2F926AB5A2F2} (Pvapplite_ie Control) - https://ondemand.ptc.com/Windchill/wtcore/j…vapplite_ie.cab
O16 - DPF: {0F7A9297-7268-11D1-B81A-00A076C01B0A} - http://www.cartesianinc.com/Products/CPCVi…k/CpcViewAX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1140064843828
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://hq-sabaweb1.ptc.com/viewer/activeXV…tivexviewer.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ptcsupport.webex.com/client/v_myweb…ort/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

LDTate

Post #15March 31, 2007, 3:20 PM UTC

Two questions: 1.Do you work for or know about REXSYSTEMS? 2. Did you install the XP Keylogger?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Hijack This Log

✨ Ask AI

Ask AI