[Resolved] Hjt Fails To Remove Ddccy.dll And Xxyvvwt.dll

I also found this thread:

http://forums.whatthetech.com/Trojan_Vundo…rus_t48741.html

I used HJT to check which programs are using which DLLs, and I found that lsass.exe and explorer.exe are the only ones using ddccy.dll.

Hi David, Good job on the research, thanks. I think your situation is a little different here though. You have some services that we need to deal with also. Did you run Combofix with the script I gave you yet? Please try that if not. If so post the log. Thanks

Hey David, Nice work. I have a question before we continue with the fix. Do you know what this service is by any chance? I can't find much on it. My inclination is to kill it but…; O23 - Service: Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS) SharedAccesshelpsvc (SharedAccesshelpsvc) - Unknown owner - C:\WINNT\System32\3076d.exe Let me know.

I'm not sure, but I think it has to do with having a Gateway tech log onto my comp remotely a week ago to fix a driver problem I was having with my CD-ROMs. I was working on getting rid of spyware (I've been hacking on this a while) and I think I trashed a registry entry, anyway he had me install something so he could get on and fix the problem. I removed all the files afterwards, but I guess the service entry might be part of it. There is no program on my system with that name.

Please copy (Ctrl C) and paste (Ctrl V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat. Please save it on your desktop.

sc stop COMSysAppSamSs
sc delete COMSysAppSamSs

sc stop dnlsvc
sc delete dnlsvc

sc stop SharedAccesshelpsvc
sc delete SharedAccesshelpsvc

exit

Double click FixServices.bat. A window will open and close. This is normal.

—————————————————————————-

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O20 - AppInit_DLLs:
O23 - Service: COM+ System Application COMSysAppSamSs (COMSysAppSamSs) - Unknown owner - C:\WINNT\System32\6to4svcx.exe (file missing)
O23 - Service: MS Software Shadow Download Provider (dnlsvc) - Unknown owner - C:\DOCUME~1\Owner\LOCALS~1\Temp\dnlsvc.exe (file missing)
O23 - Service: Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS) SharedAccesshelpsvc (SharedAccesshelpsvc) - Unknown owner - C:\WINNT\System32\3076d.exe

Then close all windows except this one and press Fix checked.

—————————————————————————-

Use ATF Cleaner to remove temp files,
cookies, cache, ect…
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

—————————————————————————–

Using Internet Explorer, click on Kaspersky Online Scanner * Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As…' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log.

The batch file ran ok. When I brought up HJT, the 023 items you mentioned did not appear. I checked the 020 and clicked fix it, and I got an error popup: An unexpected error has occurred at procedure: modBackup_MakeBackup(sItem=O20 - AppInit_DLLs: ) Error #5 - Invalid procedure call or argument Please email me at [removed], reporting the following: * What you were trying to fix when the error occurred, if applicable * How you can reproduce the error * A complete HijackThis scan log, if possible Windows version: Windows NT 5.01.2600 MSIE version: 6.0.2800.1106 HijackThis version: 1.99.1 This message has been copied to your clipboard. Click OK to continue the rest of the scan.

I tried to install the scanner, I get a popup window that says "The file '002E08D9.key' on (Unknown) is needed." Then it instructs me to type the path where the file is located, there is a window below with a default path of C:\DOCUME~1\Owner\LOCALS~1\Temp\lCD1.tmp. I did a search and there is no such file on my comp.

Yes, Kaspersky is having a problem. I've had a couple of complaints and tested it tonight myself and got the same error. I'll have to look into it. Fortunately there are other scanners.

You will need to run this with Internet Explorer.
Run Panda's ActiveScan from here and perform a full system scan.

• Once you are on the Panda site click the "Scan your PC" button
• A new window will open…click the big "Check Now" button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
• If you are on a slow connection it will take about 15 minuites for the scanner to load.
• Click on "Local Disks" to start the scan
• Once scan is done, click "see report" then "save report"
• Save the log someplace you can find
• Reboot
• Post the Panda scan results in your next reply

OK, here is the log, it looks like it's padded with a bunch of cookies that SpyEraser quarantined, but there was at least one virus that from what I can tell infected norton AV and a few other programs. I'm not sure if the log means they are still affected or not. My NAV is out of date, it's expired so I can't get new definitions, and it isn't working right any more, perhaps it's been compromised. I tried to uninstall it and couldn't, it keeps telling me I need admin priviledges. I have a security suite from Gateway that I'm waiting to install once the system is clean (I don't want to put it on a system that's messed up, and I'm still considering I may need to reformat, but I have no way atm of backing up several large directories without spending extensive time breaking them up. =========================================================================== Incident Status Location Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_01_03_2007_17_43_13.asq18467 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_01_03_2007_17_43_13.asq41 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_05_02_2007_03_02_49.asq2995 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_05_02_2007_03_02_49.asq491 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_14_08_2007_00_03_23.asq15724 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_14_08_2007_00_03_23.asq19169 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_24_02_2007_08_20_13.asq18467 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_24_02_2007_08_20_13.asq41 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_29_06_2007_06_21_29.asq26500 Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\adrevolver_29_06_2007_06_21_29.asq6334 Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Adserver.com_05_02_2007_03_02_49.asq12859 Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Adserver.com_14_08_2007_00_03_23.asq18467 Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Adserver.com_24_02_2007_08_20_13.asq32391 Adware:Adware/CommAd Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Adware.cmdService_04_09_2007_22_14_05.asq23811 Adware:Adware/DollarRevenue Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Apropos_04_09_2007_22_14_06.asq30333 Adware:Adware/CommAd Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Aurora_04_09_2007_22_14_05.asq17035 Adware:Adware/CommAd Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Aurora_04_09_2007_22_14_05.asq9894 Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\BFast.com_24_02_2007_08_20_14.asq292 Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Bravenet.com_14_08_2007_00_03_23.asq18716 Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Bravenet.com_24_02_2007_08_20_14.asq12382 Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Bravenet.com_29_06_2007_06_21_29.asq32391 Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\casalemedia.com_01_03_2007_17_43_13.asq26500 Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\casalemedia.com_04_09_2007_22_14_04.asq16827 Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\casalemedia.com_05_02_2007_03_02_49.asq27529 Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\casalemedia.com_14_08_2007_00_03_23.asq19895 Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\casalemedia.com_14_08_2007_10_07_52.asq41 Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\casalemedia.com_16_08_2007_21_50_57.asq18467 Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\casalemedia.com_24_02_2007_08_20_14.asq17421 Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\casalemedia.com_29_06_2007_06_21_29.asq14604 Spyware:Cookie/Clicktracks Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\ClickTracks_29_06_2007_06_21_30.asq28703 Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DomainSponsor.com_05_02_2007_03_02_49.asq15350 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_01_03_2007_17_43_13.asq16827 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_04_09_2007_22_14_04.asq14604 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_05_02_2007_03_02_49.asq8942 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_14_08_2007_00_03_23.asq20037 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_14_08_2007_22_49_34.asq41 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_16_08_2007_21_50_58.asq5705 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_18_08_2007_23_32_30.asq26962 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_24_02_2007_08_20_14.asq11538 Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\DoubleClick_29_06_2007_06_21_29.asq17421 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_01_03_2007_17_43_13.asq491 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_01_03_2007_17_43_13.asq9961 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_04_09_2007_22_14_04.asq12382 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_05_02_2007_03_02_49.asq27446 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_14_08_2007_00_03_24.asq22190 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_18_08_2007_23_32_30.asq24464 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_24_02_2007_08_20_14.asq23811 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_24_02_2007_08_20_14.asq31322 Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FastClick.com_29_06_2007_06_21_30.asq14771 Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FortuneCity.com_01_03_2007_17_43_13.asq2995 Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\FortuneCity.com_24_02_2007_08_20_14.asq17673 Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Hitbox.com_14_08_2007_00_03_23.asq12859 Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Hitbox.com_24_02_2007_08_20_14.asq1869 Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Hitbox.com_29_06_2007_06_21_29.asq18716 Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\hitslink.com_18_08_2007_23_32_30.asq29358 Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\hitslink.com_24_02_2007_08_20_14.asq19718 Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\HotLog.ru_04_09_2007_22_14_04.asq18716 Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\HotLog.ru_14_08_2007_00_03_24.asq1842 Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\HotLog.ru_24_02_2007_08_20_14.asq15141 Spyware:Cookie/Linksynergy Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\LinkSynergy.com_24_02_2007_08_20_14.asq28253 Spyware:Cookie/Linksynergy Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\LinkSynergy.com_29_06_2007_06_21_30.asq11538 Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\maxserving_01_03_2007_17_43_13.asq11942 Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\maxserving_05_02_2007_03_02_49.asq15006 Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\maxserving_24_02_2007_08_20_14.asq6868 Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\maxserving_29_06_2007_06_21_30.asq1869 Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Mediaplex.com_01_03_2007_17_43_13.asq4827 Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Mediaplex.com_04_09_2007_22_14_04.asq19895 Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Mediaplex.com_14_08_2007_00_03_24.asq288 Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Mediaplex.com_18_08_2007_23_32_30.asq5705 Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Mediaplex.com_24_02_2007_08_20_14.asq25547 Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Mediaplex.com_29_06_2007_06_21_30.asq19912 Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\myaffiliateprogram_14_08_2007_00_03_24.asq15006 Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\PayCounter.com_05_02_2007_03_02_49.asq31101 Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\PayCounter.com_14_08_2007_00_03_24.asq30106 Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\PayCounter.com_14_08_2007_10_07_52.asq15724 Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\PayCounter.com_29_06_2007_06_21_30.asq25667 Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\QuestionMarket.com_01_03_2007_17_43_13.asq5436 Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\QuestionMarket.com_04_09_2007_22_14_04.asq5447 Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\QuestionMarket.com_05_02_2007_03_02_49.asq3548 Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\QuestionMarket.com_14_08_2007_00_03_24.asq9040 Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\QuestionMarket.com_18_08_2007_23_32_30.asq28145 Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\QuestionMarket.com_24_02_2007_08_20_14.asq27644 Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\QuestionMarket.com_29_06_2007_06_21_30.asq26299 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_01_03_2007_17_43_13.asq32391 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_04_09_2007_22_14_04.asq21726 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_05_02_2007_03_02_49.asq19629 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_14_08_2007_00_03_24.asq8942 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_16_08_2007_21_50_58.asq16827 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_18_08_2007_23_32_30.asq23281 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_24_02_2007_08_20_14.asq32662 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_26_06_2007_18_40_15.asq11478 Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\RealMedia.com_26_06_2007_18_40_15.asq29358 Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Revenue.net_05_02_2007_03_02_50.asq12623 Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Revenue.net_14_08_2007_00_03_24.asq22648 Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Revenue.net_24_02_2007_08_20_13.asq153 Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexList.com_04_09_2007_22_14_04.asq11538 Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexList.com_14_08_2007_00_03_24.asq6729 Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexList.com_14_08_2007_10_07_52.asq11478 Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexList.com_16_08_2007_21_50_58.asq9961 Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexList.com_29_06_2007_06_21_30.asq17035 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_04_09_2007_22_14_04.asq11942 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_04_09_2007_22_14_04.asq2995 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_04_09_2007_22_14_04.asq491 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq11538 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq17035 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq17673 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq1869 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq19912 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq23811 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq25667 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq26299 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq28703 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq30333 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq31322 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq5447 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_00_03_23.asq9894 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_10_07_52.asq18467 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_14_08_2007_10_07_52.asq6334 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_16_08_2007_21_50_57.asq15724 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_16_08_2007_21_50_57.asq19169 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_16_08_2007_21_50_57.asq26500 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_24_02_2007_08_20_14.asq19895 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_24_02_2007_08_20_14.asq5447 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_29_06_2007_06_21_29.asq153 Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SexTracker.com_29_06_2007_06_21_29.asq292 Spyware:Cookie/Santa Monica networks inc Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SMNI.com_05_02_2007_03_02_50.asq24084 Spyware:Cookie/SpyLog Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SpyLog.com_24_02_2007_08_20_14.asq32757 Adware:Adware/PestCapture Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\SpySheriff_05_02_2007_03_02_48.asq23281 Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Statcounter_01_03_2007_17_43_13.asq14604 Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Statcounter_05_02_2007_03_02_50.asq19954 Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Statcounter_24_02_2007_08_20_14.asq20037 Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Statcounter_29_06_2007_06_21_30.asq9894 Spyware:Cookie/Mammamediasolutions Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Targetnet Cookie_24_02_2007_08_20_14.asq12859 Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tickle Cookie_05_02_2007_03_02_49.asq12316 Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_01_03_2007_17_43_13.asq15724 Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_01_03_2007_17_43_13.asq19169 Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_01_03_2007_17_43_13.asq26962 Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_04_09_2007_22_14_04.asq11478 Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_04_09_2007_22_14_04.asq26962 Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_04_09_2007_22_14_04.asq6334 Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_05_02_2007_03_02_49.asq15141 Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_05_02_2007_03_02_49.asq17673 Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_05_02_2007_03_02_49.asq21726 Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_05_02_2007_03_02_49.asq23811 Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_05_02_2007_03_02_49.asq292 Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_05_02_2007_03_02_49.asq32391 Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_05_02_2007_03_02_49.asq3902 Spyware:Cookie/Gorillanation Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_05_02_2007_03_02_49.asq4827 Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_14_08_2007_00_03_23.asq153 Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_14_08_2007_00_03_23.asq26962 Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_14_08_2007_00_03_23.asq29358 Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_14_08_2007_00_03_23.asq2995 Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_14_08_2007_00_03_23.asq5436 Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_14_08_2007_00_03_23.asq5705 Spyware:Cookie/Clickbank Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_14_08_2007_00_03_23.asq9961 Spyware:Cookie/Lop Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_16_08_2007_21_50_58.asq28145 Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_18_08_2007_23_32_29.asq41 Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_18_08_2007_23_32_29.asq6334 Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_24_02_2007_08_20_13.asq11942 Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_24_02_2007_08_20_13.asq15724 Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_24_02_2007_08_20_13.asq16827 Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_24_02_2007_08_20_13.asq19169 Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_24_02_2007_08_20_13.asq26500 Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_24_02_2007_08_20_13.asq491 Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_24_02_2007_08_20_13.asq6334 Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_29_06_2007_06_21_29.asq11478 Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_29_06_2007_06_21_29.asq11942 Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_29_06_2007_06_21_29.asq15724 Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Tracking Cookie_29_06_2007_06_21_29.asq491 Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\TradeDoubler.com_24_02_2007_08_20_14.asq8723 Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\TradeDoubler.com_29_06_2007_06_21_30.asq23811 Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Trafficmp Cookie_01_03_2007_17_43_13.asq3902 Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Trafficmp Cookie_24_02_2007_08_20_14.asq9741 Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Trafficmp Cookie_29_06_2007_06_21_30.asq31322 Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\TribalFusion.com_01_03_2007_17_43_13.asq153 Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\TribalFusion.com_05_02_2007_03_02_50.asq4966 Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\TribalFusion.com_14_08_2007_00_03_24.asq24370 Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\TribalFusion.com_18_08_2007_23_32_30.asq16827 Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\TribalFusion.com_24_02_2007_08_20_14.asq27529 Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\TribalFusion.com_29_06_2007_06_21_30.asq30333 Adware:Adware/CommAd Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Unclassified.Spyware.149_04_09_2007_22_14_06.asq31322 Spyware:Cookie/XXXCounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\XXXCounter.com_04_09_2007_22_14_04.asq25667 Spyware:Cookie/XXXCounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\XXXCounter.com_14_08_2007_00_03_24.asq31101 Spyware:Cookie/XXXCounter Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\XXXCounter.com_16_08_2007_21_50_58.asq491 Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Zedo Cookie_01_03_2007_17_43_13.asq292 Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Zedo Cookie_04_09_2007_22_14_04.asq26299 Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Zedo Cookie_05_02_2007_03_02_50.asq13931 Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Zedo Cookie_14_08_2007_00_03_24.asq24393 Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Zedo Cookie_24_02_2007_08_20_14.asq3035 Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Owner\Application Data\Uniblue\SpyEraser\Quarantine\Zedo Cookie_29_06_2007_06_21_30.asq4664 Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Owner\Cookies\[removed][1].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Owner\Cookies\[removed][2].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Owner\Cookies\owner@advertising[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner\Cookies\owner@atdmt[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Owner\Desktop\cleanup tools\ComboFix.exe[nircmd.exe] Spyware:Spyware/Virtumonde Not disinfected C:\Downloads\backups\backup-20070904-232924-287.dll Spyware:Spyware/Virtumonde Not disinfected C:\Downloads\backups\backup-20070904-233423-100.dll Spyware:Spyware/Virtumonde Not disinfected C:\Downloads\backups\backup-20070904-233615-464.dll Spyware:Spyware/Virtumonde Not disinfected C:\Downloads\backups\backup-20070905-000025-222.dll Spyware:Spyware/Virtumonde Not disinfected C:\Downloads\backups\backup-20070905-000947-837.dll Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\fixwareout\FindT\nircmd.exe Spyware:Spyware/Virtumonde Not disinfected C:\HJT\backups\backup-20070905-010410-189.dll Virus:W32/ZlFake.A Disinfected C:\Program Files\2Wire\2PortalMon.exe Adware:Adware/Look2Me Not disinfected C:\Program Files\2Wire\2PortalMon.exe Adware:Adware/Look2Me Not disinfected C:\Program Files\2Wire\2PortalMon.ex_ Virus:W32/ZlFake.A Disinfected C:\Program Files\Creative\SBAudigy\Program\ADGJDet.exe Adware:Adware/Look2Me Not disinfected C:\Program Files\Creative\SBAudigy\Program\ADGJDet.exe Adware:Adware/Look2Me Not disinfected C:\Program Files\Creative\SBAudigy\Program\ADGJDet.ex_ Adware:Adware/Look2Me Not disinfected C:\Program Files\HP\HP Software Update\HPWuSchd2.exe Virus:W32/ZlFake.A Disinfected C:\Program Files\Norton AntiVirus\navapw32.exe Adware:Adware/Look2Me Not disinfected C:\Program Files\Norton AntiVirus\navapw32.exe Adware:Adware/Look2Me Not disinfected C:\Program Files\Norton AntiVirus\navapw32.ex_ Virus:W32/ZlFake.A Disinfected C:\Program Files\Norton Internet Security\IAMAPP.EXE Adware:Adware/Look2Me Not disinfected C:\Program Files\Norton Internet Security\IAMAPP.EXE Adware:Adware/Look2Me Not disinfected C:\Program Files\Norton Internet Security\IAMAPP.EX_ Adware:Adware/Look2Me Not disinfected C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe Virus:Trj/Agent.GEY Disinfected C:\qoobox\Quarantine\C\WINNT\system32\6to4svcx.exe.vir Virus:Bck/Agent.GBW Disinfected C:\qoobox\Quarantine\C\WINNT\system32\regscan.exe.vir Virus:Trj/Downloader.OZB Disinfected C:\qoobox\Quarantine\C\WINNT\system32\rhqfudxa.exe.vir Virus:Generic Malware Disinfected C:\qoobox\Quarantine\catchme2007-09-05_101441.25.zip[29209.exe] Potentially unwanted tool:Application/ServUBased.A Not disinfected C:\WINNT\Config\rundll32.exe Virus:Backdoor Program Disinfected C:\WINNT\java\inf\rps.exe Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINNT\NirCmd.exe Virus:Trj/Downloader.MDW Disinfected C:\WINNT\system32\2052b.exe Virus:Trj/Downloader.MDW Disinfected C:\WINNT\system32\3076d.exe Virus:Trj/Downloader.MDW Disinfected C:\WINNT\system32\a3db.exe Virus:Trj/Downloader.MDW Disinfected C:\WINNT\system32\accwizt.exe Virus:Trj/Downloader.MDW Disinfected C:\WINNT\system32\acluiv.dll Virus:Trj/Downloader.MDW Disinfected C:\WINNT\system32\adsldpx.exe Adware:Adware/SecurityError Not disinfected C:\WINNT\system32\xlibgfl254.dll Adware:Adware/Look2Me Not disinfected C:\WINNT\UpdReg-back.EXE

Hi David,

If the virus definitions on your Norton have run out you want to remove that ASAP. Norton can be a bear to remove, hence the need for "special" removal tools. Why they don't design these "special" removal tools right INTO their product is beyond me (but don't get me started on Norton, oops, too late).
This is right from their web site:

http://service1.symantec.com/SUPPORT/tsgen…005033108162039

Unless they are false positives from Panda, which could be the case?, it looks like you were infected by Look2Me at one point. Although up to the Panda scan I did not see any evidence of it. Any thoughts there? Something in the past maybe?

I may be wrong here but let's run a scan for Look2Me. Run only the scan now.

Download L2mfix from one of these two locations:

http://www.downloads.subratam.org/l2mfix.exe
http://www.atribune.org/downloads/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe,
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."…then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.


I'm putting together the rest of the fix for you now. If you had any information on my question that would help too.

Please post a fresh HJT log too.

Thanks

Hi David,

Yes, nothing bad that I can see in Look2Me log. You're right on with the new BHO, and it's a baddie. Where did that come from???

Keyword hijacker, file located in a -"Program Files\WinBudget\bin" directory, detected by Kaspersky antivirus as AdWare.Win32.BHO.by - - NOTE: Do not confuse with the legitimate Budget_For_Windows file of the same name!

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O2 - BHO: TB Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll

Then close all windows except this one and press Fix checked.

You can also delete the folder using Windows Explorer.

C:\Program Files\WinBudget

I have posted a reg fix based on your Combofix log also to be reviewed by an expert/teacher here and will post that when I get a response.

While we're waiting on the reg fix, can you give me a line-by-line blurb of what the rest of the stuff in the HJT log is doing? A lot of it I can't make heads or tails of, and it can probably be killed.

Hey Dave, Well, some of the lines are pretty self-explanatory, like anything that says Norton obviously is your AV, ect…and you don't want to kill those. Rather than have me have to go through every other line why don't you post back with ones your not sure of and I'll give you my take on it and whether or not it can be killed. Hopefully that's Okay.