Spyware / Malware / Virus Removal

[Resolved] Kurdsoft?

16 min read

Looking for the outcome? Ask AI

normn1 Topic Starter

Post #1September 20, 2007, 7:30 AM UTC

I was Wondering if anyone could help me determine if my pc is infected, and to what extent.

This is my dilemma:

Upon System Boot my web browser(IE7) periodically opens iself and tries to go to www.kurdsofts.com/htm, but comes up with page not found error.
i since added the site url to the pccillin restricted websites list

hijack this log is as follows…
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:08:44 AM, on 9/20/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\aol\1190226841\ee\aolsoftware.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
F:\Program Files\AOL 9.0\waol.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\USERS\NORM\APPDATA\ROAMING\MICROSOFTAPP32\NETCMD.EXE
F:\Program Files\AOL 9.0\shellmon.exe
C:\Windows\System32\mobsync.exe
M:\Safety\HiJackThis.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1190226841\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Win32up] c:\users\norm\appdata\roaming\netconfig.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Download All with Rapidshare Downloader - C:\Users\Norm\AppData\Local\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download with Rapidshare Downloader - C:\Users\Norm\AppData\Local\Temp\RarSFX0\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

–
End of file - 6869 bytes

IndiGenus

Post #2September 20, 2007, 9:00 PM UTC

Hi Normn1 and welcome to the forums.

I'm not quite sure why you were getting redirected to that address. The base address (www.kurdsofts.com) is an Apache server.

The one thing that does stick out is this line:

O4 - HKCU\..\Run: [Win32up] c:\users\norm\appdata\roaming\netconfig.exe

Have you any idea what this is or would be related to? I'm thinking it's malcious, the netconfig.exe file is known to be a password stealing trojan, but I just haven't seen it in that location. Let's have you upload that file to Jotti, or one of the others to see what is found.

Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

c:\users\norm\appdata\roaming\netconfig.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/en/indexf.html

normn1

Post #3September 20, 2007, 10:09 PM UTC

Here is The Scan Results, Hope You Can Help, And Thank You In Advance: Service load: 0% 100% File: netconfig.exe Status: INFECTED/MALWARE MD5: cbe2cb74be8b9d2f24e523ac8ad97656 Packers detected: PE_PATCH.UPX, UPX Bit9 reports: Not analyzed yet (more info) Scan taken on 20 Sep 2007 21:58:43 (GMT) A-Squared Found Backdoor.Win32.VB.aya AntiVir Found TR/Crypt.FKM.Gen ArcaVir Found Trojan.Vb.Aya Avast Found Win32:VB-DAJ AVG Antivirus Found PSW.Generic4.RHA BitDefender Found Trojan.Spy.Vb.NB ClamAV Found Trojan.VB-1049 CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found W32/Backdoor.BKDL F-Secure Anti-Virus Found Backdoor.Win32.VB.aya Fortinet Found nothing Kaspersky Anti-Virus Found Backdoor.Win32.VB.aya NOD32 Found a variant of Win32/Spy.VB.NB Norman Virus Control Found W32/VBDoor.DOG Panda Antivirus Found Trj/Ayoxlogger.O Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found P2P-Worm.Win32.Polip.a Last file scanned at least one scanner reported something about: Xilisoft_CD_Ripper_v1.0.36.0719.exe (MD5: adc0aaec325d3b8a6cf05f251d974623, size: 4541854 bytes), detected by: Scanner Malware name A-Squared X AntiVir X ArcaVir Trojan.Prorat.19.I Avast Win32:Trojan-gen. {Delphi} AVG Antivirus X BitDefender X ClamAV X CPsecure X Dr.Web X F-Prot Antivirus X F-Secure Anti-Virus X Fortinet X Kaspersky Anti-Virus X NOD32 X Norman Virus Control X Panda Antivirus X Rising Antivirus X Sophos Antivirus X VirusBuster X VBA32 X

IndiGenus

Post #4September 20, 2007, 10:49 PM UTC

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Win32up] c:\users\norm\appdata\roaming\netconfig.exe

Then close all windows except this one and press Fix checked.

You may need to re-enable hidden files and folders like last time if you switched back already.

Using Windows Explorer delete the following file.

c:\users\norm\appdata\roaming\netconfig.exe

Reboot now.

———————————

Using Internet Explorer, click on Kaspersky Online Scanner * Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As…' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log.

normn1

Post #5September 21, 2007, 7:17 AM UTC

Here is The info you requested ,Hope you can help… my PC looks Screwed Up!

KASPERSKY ONLINE SCANNER REPORT
Friday, September 21, 2007 1:57:41 AM
Operating System: Microsoft Windows Vista Home Edition, (Build 6000)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 21/09/2007
Kaspersky Anti-Virus database records: 421444

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan Statistics
Total number of scanned objects 242215
Number of viruses found 5
Number of infected objects 16
Number of suspicious objects 0
Duration of the scan process 03:17:41

Infected Object Name Virus Name Last Action
C:\$Recycle.Bin\S-1-5-21-325515783-1120560481-1999898136-1000\$RN54QF2.exe Infected: Backdoor.Win32.VB.aya skipped

C:\Boot\BCD Object is locked skipped

C:\Boot\BCD.LOG Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012007092020070921\index.dat Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\UsrClass.dat{5126cf05-6751-11dc-b078-001921549e03}.TM.blf Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\UsrClass.dat{5126cf05-6751-11dc-b078-001921549e03}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows\UsrClass.dat{5126cf05-6751-11dc-b078-001921549e03}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped

C:\Users\Norm\AppData\Local\Microsoft\Windows Sidebar\Settings.ini Object is locked skipped

C:\Users\Norm\AppData\Local\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped

C:\Users\Norm\AppData\Local\Temp\Low\~DF7CB9.tmp Object is locked skipped

C:\Users\Norm\AppData\Local\Temp\Low\~DF7DBD.tmp Object is locked skipped

C:\Users\Norm\AppData\Local\Temp\NERO13366\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped

C:\Users\Norm\AppData\Local\Temp\~DF72F8.tmp Object is locked skipped

C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped

C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat Object is locked skipped

C:\Users\Norm\AppData\Roaming\MicrosoftApp32\netcmd.exe Infected: Backdoor.Win32.VB.aya skipped

C:\Users\Norm\AppData\Roaming\netconfig.exe Infected: Backdoor.Win32.VB.aya skipped

C:\Users\Norm\ntuser.dat Object is locked skipped

C:\Users\Norm\ntuser.dat.LOG1 Object is locked skipped

C:\Users\Norm\ntuser.dat.LOG2 Object is locked skipped

C:\Users\Norm\ntuser.dat{5126cf01-6751-11dc-b078-001921549e03}.TM.blf Object is locked skipped

C:\Users\Norm\ntuser.dat{5126cf01-6751-11dc-b078-001921549e03}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

C:\Users\Norm\ntuser.dat{5126cf01-6751-11dc-b078-001921549e03}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

C:\Windows\Debug\PASSWD.LOG Object is locked skipped

C:\Windows\Debug\sam.log Object is locked skipped

C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped

C:\Windows\Logs\DPX\setupact.log Object is locked skipped

C:\Windows\Logs\DPX\setuperr.log Object is locked skipped

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config Object is locked skipped

C:\Windows\Panther\UnattendGC\diagerr.xml Object is locked skipped

C:\Windows\Panther\UnattendGC\diagwrn.xml Object is locked skipped

C:\Windows\Panther\UnattendGC\setupact.log Object is locked skipped

C:\Windows\Panther\UnattendGC\setuperr.log Object is locked skipped

C:\Windows\S6E22AE45.tmp Object is locked skipped

C:\Windows\security\database\secedit.sdb Object is locked skipped

C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped

C:\Windows\System32\catroot2\edb.log Object is locked skipped

C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped

C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped

C:\Windows\System32\config\components Object is locked skipped

C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked skipped

C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked skipped

C:\Windows\System32\config\default Object is locked skipped

C:\Windows\System32\config\DEFAULT.LOG1 Object is locked skipped

C:\Windows\System32\config\DEFAULT.LOG2 Object is locked skipped

C:\Windows\System32\config\sam Object is locked skipped

C:\Windows\System32\config\SAM.LOG1 Object is locked skipped

C:\Windows\System32\config\SAM.LOG2 Object is locked skipped

C:\Windows\System32\config\security Object is locked skipped

C:\Windows\System32\config\SECURITY.LOG1 Object is locked skipped

C:\Windows\System32\config\SECURITY.LOG2 Object is locked skipped

C:\Windows\System32\config\software Object is locked skipped

C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked skipped

C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked skipped

C:\Windows\System32\config\system Object is locked skipped

C:\Windows\System32\config\SYSTEM.LOG1 Object is locked skipped

C:\Windows\System32\config\SYSTEM.LOG2 Object is locked skipped

C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped

C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped

C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

C:\Windows\System32\restore\MachineGuid.txt Object is locked skipped

C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped

C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped

C:\Windows\System32\wbem\repository\INDEX.BTR Object is locked skipped

C:\Windows\System32\wbem\repository\MAPPING1.MAP Object is locked skipped

C:\Windows\System32\wbem\repository\MAPPING2.MAP Object is locked skipped

C:\Windows\System32\wbem\repository\OBJECTS.DATA Object is locked skipped

C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Client%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Server%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DateTimeControlPanel%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-MSDT%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PLA%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Networking%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnostic%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticResolver%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Forwarding%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Help%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WDI%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-MeetingSpace%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-MemoryDiagnostics-Results%4Debug.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ParentalControls%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Admin.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winsock-WS2HELP%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wired-AutoConfig%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Setup.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped

C:\Windows\Tasks\1-Click Maintenance.job Object is locked skipped

C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped

C:\Windows\WindowsUpdate.log Object is locked skipped

C:\Windows\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6000.16386_none_cef7ceb03914a67f\dnary.xsd Object is locked skipped

F:\Rapidshare\AntiRapidshare2007.exe/AutoPlay/Docs/RapidSearch.exe Infected: Backdoor.Win32.VB.aya skipped

F:\Rapidshare\AntiRapidshare2007.exe ZIP: infected - 1 skipped

F:\Rapidshare\AntiRapidshare2007.rar.exe/data.rar/AntiRapidshare2007.exe/AutoPlay/Docs/RapidSearch.exe Infected: Backdoor.Win32.VB.aya skipped

F:\Rapidshare\AntiRapidshare2007.rar.exe/data.rar/AntiRapidshare2007.exe Infected: Backdoor.Win32.VB.aya skipped

F:\Rapidshare\AntiRapidshare2007.rar.exe/data.rar Infected: Backdoor.Win32.VB.aya skipped

F:\Rapidshare\AntiRapidshare2007.rar.exe RarSFX: infected - 3 skipped

F:\Rapidshare\N.7.10.1.0.By.DeViL.part1\Nero 7.10.1.0\Keygen.exe Object is locked skipped

G:\Documents and Settings\All Users\Application Data\Brother\BrLog\BrDbgOut.INI Object is locked skipped

G:\Documents and Settings\All Users\Application Data\Brother\BrLog\BrtINS32.log Object is locked skipped

G:\Documents and Settings\All Users\Application Data\Brother\BrLog\BrtINST.log Object is locked skipped

G:\Documents and Settings\All Users\Application Data\Brother\BrLog\BrtINSTL.log Object is locked skipped

G:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2dfda61398c15578b636f8deacbabdb7_3960dd35-7d81-4703-904b-d2a22f26d4ca Object is locked skipped

G:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9c4d85b87d7ce4e2266e3ad33d98e11e_3960dd35-7d81-4703-904b-d2a22f26d4ca Object is locked skipped

G:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bb864149799f5677db7cc682bc10d915_3960dd35-7d81-4703-904b-d2a22f26d4ca Object is locked skipped

G:\Documents and Settings\All Users\Application Data\Microsoft\eHome\Recording\Recordings.xml Object is locked skipped

G:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

G:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat_BAK_30492 Object is locked skipped

G:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

G:\Documents and Settings\LocalService\ntuser.dat_BAK_81679 Object is locked skipped

G:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

G:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat_BAK_46755 Object is locked skipped

G:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

G:\Documents and Settings\NetworkService\NTUSER.DAT_BAK_12354 Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\Ashampoo WinOptimizer Platinum 3.lnk Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\direct deposit enrollment.txt Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\Garmin GPS\Shortcut to WebUpdater.lnk Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\New Downloads\mobil_edit_v2.3.0.7\MOBILedit! v2.3.0.7\Serial.txt Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\New Text Document.txt Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\Phone Bill.bmp Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\Rapidshare Links.txt Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\Raw Danger 2.txt Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\raw danger print.txt Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\raw danger.txt Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\unum.txt Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\Unused Desktop Shortcuts\Windows Vista Upgrade Advisor.lnk Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\WM Recorder 11.3.lnk Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat_BAK_96246 Object is locked skipped

G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\ntuser.dat_BAK_66039 Object is locked skipped

G:\My Games\JEOPARDY! 2\Jeopardy! 2.exe Object is locked skipped

G:\My Games\Mind Medley\MindMedley.exe Object is locked skipped

G:\pagefile.sys Object is locked skipped

G:\Program Files\Canon\Easy-PhotoPrint\uninst.ini Object is locked skipped

G:\Program Files\Canon\MyPrinter\uninst.ini Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\ChappellesShowSeason24361_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\ChappellesShowSeason24361_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\CSICrimeSceneInvestiga2733_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\CSICrimeSceneInvestiga4343_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\CSICrimeSceneInvestiga4343_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\CSICrimeSceneInvestigatio4459_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\CSICrimeSceneInvestigatio4459_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\DeuceBigalowEuropeanGigolo4498_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\DeuceBigalowEuropeanGigolo4498_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\KolchakTheNightStalker14972_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\KolchakTheNightStalkerTh4933_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\KolchakTheNightStalkerTh4933_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\LostinSpaceTheCompleteF4987_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\LostinSpaceTheCompleteF4987_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\MindofMenciaUncensoredSea4527_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\MindofMenciaUncensoredSea4527_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\NorbitNorbit20075197_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\NorbitNorbit20075197_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\QuincyMESeasons125129_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\QuincyMESeasons125129_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\That70sShowSeasonOne13870_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\TheDeparted20064460_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\TheDeparted20064460_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\TheDeparted20064466_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\TheDeparted20064466_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\TheNumber23Unrated20075156_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\TheNumber23Unrated20075156_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\WarOfTheWorlds20055091_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\WarOfTheWorlds20055091_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\WolfCreekUnrated20054459_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\WolfCreekUnrated20054459_f.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\WolfCreekUnrated20054563_b.jpg Object is locked skipped

G:\Program Files\Collectorz.com\Movie Collector\Data\Images\WolfCreekUnrated20054563_f.jpg Object is locked skipped

G:\Program Files\InstallShield Installation Information\{00FC6799-866E-44A1-A60C-DCF394CF56FD}\Setup.ilg Object is locked skipped

G:\Program Files\InstallShield Installation Information\{AB316D08-87F3-458E-9327-319527F40942}\setup.ilg Object is locked skipped

G:\Program Files\TGTSoft\StyleXP\Boot Screens\ntoskrnl.exe/WISE0015.BIN/Sync.exe Infected: not-a-virus:AdWare.Win32.SaveNow.v skipped

G:\Program Files\TGTSoft\StyleXP\Boot Screens\ntoskrnl.exe/WISE0015.BIN/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.v skipped

G:\Program Files\TGTSoft\StyleXP\Boot Screens\ntoskrnl.exe/WISE0015.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.v skipped

G:\Program Files\TGTSoft\StyleXP\Boot Screens\ntoskrnl.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.Quick.a skipped

G:\Program Files\TGTSoft\StyleXP\Boot Screens\ntoskrnl.exe/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

G:\Program Files\TGTSoft\StyleXP\Boot Screens\ntoskrnl.exe WiseSFX: infected - 5 skipped

G:\WINDOWS\repair\default Object is locked skipped

G:\WINDOWS\repair\SAM Object is locked skipped

G:\WINDOWS\repair\SECURITY Object is locked skipped

G:\WINDOWS\repair\software Object is locked skipped

G:\WINDOWS\repair\system Object is locked skipped

G:\WINDOWS\Startup (disabled)\AOL OpenRide.lnk Object is locked skipped

G:\WINDOWS\system32\config\default Object is locked skipped

G:\WINDOWS\system32\config\default_BAK_52783 Object is locked skipped

G:\WINDOWS\system32\config\SAM Object is locked skipped

G:\WINDOWS\system32\config\SAM_BAK_59854 Object is locked skipped

G:\WINDOWS\system32\config\SECURITY Object is locked skipped

G:\WINDOWS\system32\config\SECURITY_BAK_23154 Object is locked skipped

G:\WINDOWS\system32\config\software Object is locked skipped

G:\WINDOWS\system32\config\software_BAK_79170 Object is locked skipped

G:\WINDOWS\system32\config\system Object is locked skipped

G:\WINDOWS\system32\config\system_BAK_42745 Object is locked skipped

G:\WINDOWS\system32\wbem\AutoRecover\8858F1BA0D460E5A5B27AB13DE3ACB5D.mof Object is locked skipped

G:\WINDOWS\system32\wbem\AutoRecover\8A94AF24F162D580E3D9889344A3A317.mof Object is locked skipped

G:\WINDOWS\twain_32\BrMfSc03\MF210CU\brTwdFe.dsx Object is locked skipped

Scan process completed.

Hijackthis Info is:

Logfile of HijackThis v1.99.1
Scan saved at 2:07:44 AM, on 9/21/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\aol\1190226841\ee\aolsoftware.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\USERS\NORM\APPDATA\ROAMING\MICROSOFTAPP32\NETCMD.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\explorer.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Users\Norm\AppData\Local\Temp\RarSFX0\jccatch.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1190226841\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Win32up] c:\users\norm\appdata\roaming\netconfig.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: &Download All with Rapidshare Downloader - C:\Users\Norm\AppData\Local\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download with Rapidshare Downloader - C:\Users\Norm\AppData\Local\Temp\RarSFX0\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Thanks For Offering Your Help!

IndiGenus

Post #6September 21, 2007, 1:10 PM UTC

Hi Normn1,

What are you using Rapidshare for? It appears to have planted a backdoor trojan on your machine. We may be able to fix this but there are no guarantees with this type of thing. Here is my "warning" on that.

One or more of the identified infections is a backdoor trojan.

This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

However, if you do not have the resources to reinstall your computer and would like me to attempt to clean it, I will be happy to do so. There are excellent tools and resources to remove these infections but there are no guarantees.

Should you have any questions, please feel free to ask.

Please let us know what you have decided to do in your next post.

normn1

Post #7September 21, 2007, 6:27 PM UTC

I would like to clean it first if possible … Can You Help?

IndiGenus

Post #8September 21, 2007, 6:29 PM UTC

I will certainly try, and if I'm stuck there are others here to help too. You didn't answer my question about Rapidshare.

IndiGenus

Post #9September 21, 2007, 6:31 PM UTC

Also I noticed your last HJT log was from 1.99.1, but your first was from 2.0.2. Can you use only the 2x version from now on, it is designed better for Vista.

normn1

Post #10September 21, 2007, 6:47 PM UTC

downloades some short videos from it

IndiGenus

Post #11September 21, 2007, 7:01 PM UTC

Well I can't say for sure but that's probably where you're getting infected from. My fix will include removing anything that Kaspersky found, which was at least some of Rapidshare. We don't condone or advise the use of P2P, torrents, or any file sharing here. But I'll do my best to help clean you up Okay? I will post back in a bit with a fix. Dave

IndiGenus

Post #12September 21, 2007, 7:07 PM UTC

Please note this fix may disable any Rapidshare functions you may have. It's up to you at this point.

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Win32up] c:\users\norm\appdata\roaming\netconfig.exe

Then close all windows except this one and press Fix checked.

———————————-

Please download the OTMoveIt by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Users\Norm\AppData\Local\Temp\NERO13366\Toolbar.exe
C:\Users\Norm\AppData\Roaming\MicrosoftApp32\netcmd.exe
C:\Users\Norm\AppData\Roaming\netconfig.exe
F:\Rapidshare\AntiRapidshare2007.exe
F:\Rapidshare\AntiRapidshare2007.rar.exe
Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
Close OTMoveIt

*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.
**If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")

Click "Exit" to close OTMoveIt.

————————————-

Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:

Click the Update icon at the top and under Manual Update click the Start update button.
The program will either update or inform you that no update was available.
It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).

Please set up the program as follows:

Click the Shield icon at the top and under Resident shield is… click active. This should now
change to inactive.
Click the Update icon and untick the automatic update option.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act? - make sure that Quarantine is selected.
Under How to scan? - All checkboxes should be ticked.
Under Possibly unwanted software - All checkboxes should be ticked.
Under Reports - Select Do not automatically generate reports.
Under What to scan? - Select Scan every file.

Close all open windows.

Please download ATF Cleaner here by Atribune. This program is for XP and Windows 2000 only.
It does not require any installation and uses minimal system resources. It is set up to clean IE, FireFox and Opera, and detects the browsers you have and grays out the other(s).

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Recommend UNCHECKING COOKIES if you rely on system remembered passwords.
Click the Empty Selected button.

If you use Firefox browser
Click Firefox at the top and choose: Select All EXCEPT FIREFOX SAVED PASSWORDS
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser
Click Opera at the top and choose: Select All EXCEPT COOKIES AND SAVED PASSWORDS
Click the Empty Selected button.
NOTE: If you would like to keep your cookies and saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

We Now Need To Boot Into Safemode Now

Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine,
amount of memory, hard drives installed etc (BOOT SCREEEN).
At this point you should gently tap the F8 key repeatedly until you are presented with a Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Run AVG

Click on Scanner on the toolbar.
Click on Complete System Scan to start the scan process.
Let the program scan your computer.
When the scan has finished, follow the instructions below:
- Make sure that Set all elements to: shows Quarantine
- Important: Click on the Apply all Actions button This must done before saving the report
- When the program has finished, it will display the message All actions have been applied.
- Then click the Save Scan Report button.
- Click the Save Report as button.
- Save the report to your Desktop.
  [external image: Posted Image]
Right-click the AVG Tray Icon and select Exit.
Now copy the report back to this topic.

Restart into normal mode and post the AVG Log and a new HJT Log. Also how are things now

One last request. Please upload this file to Jotti or one of the others as you did earlier. Only the one from this location. There will be other files with this name on your computer that are valid, we only want the one in this directory.

G:\Program Files\TGTSoft\StyleXP\Boot Screens\ntoskrnl.exe

Post results from that also.

normn1

Post #13September 21, 2007, 7:50 PM UTC

one thing before i start.. ihave pccillin av, do i need to uninstall?

IndiGenus

Post #14September 21, 2007, 7:56 PM UTC

Nope, it's just fine as it is.

normn1

Post #15September 25, 2007, 1:47 AM UTC

Here Is the InfoYou Asked For:

C:\Users\Norm\AppData\Local\Temp\NERO13366\Toolbar.exe moved successfully.
C:\Users\Norm\AppData\Roaming\MicrosoftApp32\netcmd.exe moved successfully.
C:\Users\Norm\AppData\Roaming\netconfig.exe moved successfully.
F:\Rapidshare\AntiRapidshare2007.exe moved successfully.
F:\Rapidshare\AntiRapidshare2007.rar.exe moved successfully.

Created on 09/24/2007 18:09:58

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 8:21:58 PM 9/24/2007

+ Scan result:

C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.28:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.29:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.33:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.605:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.892:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@aoluk.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@blockbuster.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@brightcove.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@microsoftconsumermarketing.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@projectorpeople.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@safaribooks.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Adbrite : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@adengage[1].txt -> TrackingCookie.Adengage : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][3].txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.101:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.107:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.98:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.99:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.23:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.271:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Burstbeacon : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@clickbank[2].txt -> TrackingCookie.Clickbank : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Clickhype : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@com[1].txt -> TrackingCookie.Com : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@com[1].txt -> TrackingCookie.Com : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Directnetadvertising : Cleaned.
:mozilla.51:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.842:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.843:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.844:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.849:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.867:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.868:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.875:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.876:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.878:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.879:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.50:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.52:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.53:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.54:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@hotlog[2].txt -> TrackingCookie.Hotlog : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@hotlog[2].txt -> TrackingCookie.Hotlog : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Information : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Live : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Live : Cleaned.
:mozilla.479:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.480:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.520:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.521:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.523:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.528:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.539:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.540:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.6:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.8:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.9:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][6].txt -> TrackingCookie.Liveperson : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.693:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.695:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.455:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.467:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Netflame : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Netflame : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@overture[2].txt -> TrackingCookie.Overture : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
:mozilla.214:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Paypal : Cleaned.
G:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Paypal : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Paypal : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@pro-market[1].txt -> TrackingCookie.Pro-market : Cleaned.
:mozilla.615:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.616:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.562:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Real : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@real[1].txt -> TrackingCookie.Real : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Real : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt -> TrackingCookie.Real : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@real[1].txt -> TrackingCookie.Real : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt -> TrackingCookie.Real : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Real : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@real[1].txt -> TrackingCookie.Real : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Real : Cleaned.
:mozilla.579:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@realmedia[2].txt -> TrackingCookie.Realmedia : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.26:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.27:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.30:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.32:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.34:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.35:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.36:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.37:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.38:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@revsci[1].txt -> TrackingCookie.Revsci : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@revsci[1].txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.845:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.846:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.497:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.498:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.499:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.500:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.501:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed]-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed]-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.184:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.185:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.186:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.445:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.465:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.15:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.16:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.17:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.18:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.19:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.20:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.404:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.403:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.535:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Valueclick : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@webstat[1].txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.112:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.113:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt -> TrackingCookie.Webtrends : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\[removed][2].txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.464:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.137:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Cookies\owner@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.117:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.118:G:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Application Data\Netscape\Navigator\Profiles\dtuvxn2v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Zedo : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\Low\norm@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\Users\Norm\AppData\Roaming\Microsoft\Windows\Cookies\norm@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.

::Report end

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:40:58 PM, on 9/24/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\aol\1190226841\ee\aolsoftware.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1190226841\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

–
End of file - 6938 bytes

Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1

File to upload & scan:
Service
Service load: 0% 100%

File: ntoskrnl.exe
Status: INFECTED/MALWARE
MD5: 34a4a6b7571146da54b907a507e4165b
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 24 Sep 2007 23:00:15 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found Dropped:Adware.Savenow.DH, Trojan.Dloader.HK, Adware.Newdotnet.F
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found Adware.SaveNow, Adware.NewDotNet
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found not-a-virus:AdWare.Win32.SaveNow.v (4, 1, 400), not-a-virus:AdWare.Win32.Quick.a (4, 1, 400), not-a-virus:AdWare.Win32.NewDotNet (4, 1, 400)
Fortinet Found nothing
Kaspersky Anti-Virus Found not-a-virus:AdWare.Win32.SaveNow.v, not-a-virus:AdWare.Win32.Quick.a, not-a-virus:AdWare.Win32.NewDotNet
NOD32 Found Win32/Adware.SaveNow application, Win32/Adware.QuickSearchBar application, Win32/Adware.NdotNet application
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found Troj/Dloader-HK
VirusBuster Found nothing
VBA32 Found nothing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Kurdsoft?

✨ Ask AI

Ask AI