DJBits
Topic Starter
I'm not sure what malware caused this but on reboot I can login normally and initially the taskbar appears along with the desktop shortcuts then they all are cleared leaving me only with wallpaper. Left/right clicking has no affect. I can go into task manager and launch processes manually and get outlook and firefox to load but it will not start and explorer nor can I start the app to edit the startup sequence. I can launch Vista Start Menu and it will come up but I can't start any kind of app from it that is an explorer like tool. When I do start it the taskbar and shortcuts re-appear briefly and then disappear. If I act quickly I can actually launch an app. It's almost like something is polling in the background every 5 seconds and killing certain apps off.
Another thing is the system restore seems to be handicapped. While it shows bold days for save points in the past on many days I can not access them, it only displays the most recent one which is when the malware kicked into gear. I've run several virus checks including AVG and Panda which found add and spyware but nothing that looked like a lethal virus. The logs for Hijack and AVG are below
I'm running XP Pro SP3 - it's an OEM machine so I can't run a repair off a CD since it didn't come with a disk. Any help in sorting this is greatly appreciated!
thanks - DanD
Logfile of HijackThis v1.99.1
Scan saved at 11:54:59 PM, on 7/8/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\SWF Printer Pro\swfpagent.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Vista Start Menu\VistaStartMenu.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Dan D*****\My Documents\Downeloads from the net\VundoFix.exe
C:\Program Files\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.verizon.net/help/fios_settings…zer/Default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: sqvgnrpx - {9437C997-89E6-4B84-A745-BEFD3A910FF5} - C:\WINDOWS\sqvgnrpx.dll (file missing)
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic 6\delay.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [SWF Printer Agent] "C:\Program Files\SWF Printer Pro\swfpagent.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [StickyPassword] C:\Program Files\Sticky Password\stpass.exe
O4 - HKCU\..\Run: [Titan Backup] "C:\PROGRA~1\TITANB~1\Titanbackup.exe" /startup
O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Vista Start Menu\VistaStartMenu.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: ATI Tray Tools.lnk = C:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.exe
O4 - Startup: WireKeys.lnk = C:\Program Files\WiredPlane\WireKeys\WireKeys.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Compress Image Using Image Compressor 2008 - C:\Program Files\MasRizal\IMC2008\imcieex_compress.html
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {44226DFF-747E-4edc-B30C-78752E50CD0C} - (no file)
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1134415597281
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1152473287207
O16 - DPF: {CAFECAFE-0013-0001-0018-ABCDEFABCDEF} (JInitiator 1.3.1.18) - http://tgtoasdev1.targetsite.com:7777/form…iator/jinit.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Phoenix VCD Service (PhnxVCDService) - Phoenix Technologies Ltd. - C:\WINDOWS\system32\PhnxCDSvr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: WMDM PMSP Service - Unknown owner - C:\WINDOWS\system32\MsPMSPSv.exe (file missing)
==========================================
AVG log
"Scan ""Scan whole computer"" was finished."
"Infections found:";"23"
"Infected objects removed or healed";"23"
"Not removed or healed.";"0"
"Spyware found:";"3"
"Spyware removed:";"3"
"Not removed:";"0"
"Warnings count:";"45"
"Information count:";"0"
"Scan started:";"Tuesday, July 08, 2008, 10:53:40 AM"
"Total object scanned:";"1102686"
"Time needed:";"1 hour(s) 44 minute(s) 24 second(s) "
"Errors encountered:";"0"
"Infections"
"File";"Infection";"Result"
"C:\WINDOWS\sqvgnrpx.dll";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\WINDOWS\fdxbameg.dll";"Trojan horse Downloader.Adload.NT";"Moved to Virus Vault"
"C:\WINDOWS\wbxdpgfevkl.dll";"Trojan horse Downloader.Adload.NK";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\226[1].exe";"Trojan horse SHeur.BRPU";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\sqvgnrpx.dll";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\fdxbameg.dll";"Trojan horse Downloader.Adload.NT";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\wbxdpgfevkl.dll";"Trojan horse Downloader.Adload.NK";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\gpefaowr.exe";"Trojan horse Downloader.Adload.NI";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\egxk.exe";"Trojan horse Downloader.Adload.NA";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\sqvgnrpx.dll";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\fdxbameg.dll";"Trojan horse Downloader.Adload.NT";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\wbxdpgfevkl.dll";"Trojan horse Downloader.Adload.NK";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\gpefaowr.exe";"Trojan horse Downloader.Adload.NI";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\egxk.exe";"Trojan horse Downloader.Adload.NA";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\My Documents\My Music\Lime\Native.Instruments.Battery.VSTi.DXi.RTAS.v2.0.0.8.incl.KeyGen-H2O.zip:\h-niba2e.zip:\h-niba2.r03:\nibat2kg.exe";"Trojan horse Generic10.AMTZ";"Deleted"
"C:\Documents and Settings\Dan D*****\My Documents\My Music\Lime\Native.Instruments.Battery.VSTi.DXi.RTAS.v2.0.0.8.incl.KeyGen-H2O.zip:\h-niba2e.zip:\h-niba2.r03";"Trojan horse Generic10.AMTZ";"Deleted"
"C:\Documents and Settings\Dan D*****\My Documents\My Music\Lime\Native.Instruments.Battery.VSTi.DXi.RTAS.v2.0.0.8.incl.KeyGen-H2O.zip:\h-niba2e.zip";"Trojan horse Generic10.AMTZ";"Deleted"
"C:\Documents and Settings\Dan D*****\My Documents\My Music\Lime\Native.Instruments.Battery.VSTi.DXi.RTAS.v2.0.0.8.incl.KeyGen-H2O.zip";"Trojan horse Generic10.AMTZ";"Deleted"
"C:\System Volume Information\_restore{2C4EEC66-1D4D-4D88-B177-DA8A21110D8A}\RP736\A0210716.dll";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{2C4EEC66-1D4D-4D88-B177-DA8A21110D8A}\RP736\A0210717.dll";"Trojan horse Downloader.Adload.NT";"Moved to Virus Vault"
"C:\System Volume Information\_restore{2C4EEC66-1D4D-4D88-B177-DA8A21110D8A}\RP736\A0210718.dll";"Trojan horse Downloader.Adload.NK";"Moved to Virus Vault"
"Spyware"
"File";"Infection";"Result"
"C:\Documents and Settings\Dan D*****\My Documents\Downeloads from the net\Cliprexdsfree.exe:\$JJ\SRSAI.exe";"Adware Generic3.HBO";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\My Documents\Downeloads from the net\Cliprexdsfree.exe:\$JJ\rkinstaller.exe";"Adware Generic.KUZ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\My Documents\Downeloads from the net\Cliprexdsfree.exe";"Adware Generic3.HBO";"Moved to Virus Vault"
"Warnings"
"File";"Infection";"Result"
"C:\Documents and Settings\Dan D*****\Cookies\dan_D*****@2o7[2].txt:\2o7.net.bab0b6da";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Cookies\dan_D*****@2o7[2].txt";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\adrevolver.com.9b9d670a";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\adrevolver.com.f6cfcad4";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\media.adrevolver.com.5fed601d";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\yadro.ru.c77afad5";"Found Tracking cookie.Yadro";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.607ec6d0";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.574ccbf5";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.e0ebdba8";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.4fb72cc";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.be71625c";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\stat.dealtime.com.f58c396a";"Found Tracking cookie.Dealtime";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\2o7.net.484dbb69";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\2o7.net.7c5cd6ef";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\searchportal.information.com.3a8d7204";"Found Tracking cookie.Information";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\tribalfusion.com.dcc03271";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\burstnet.com.a3218a37";"Found Tracking cookie.Burstnet";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt:\fastclick.net.9b41aa53";"Found Tracking cookie.Fastclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt:\fastclick.net.bb8bcae";"Found Tracking cookie.Fastclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt:\trafficmp.com.e56c223c";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt";"Found Tracking cookie.Fastclick";"Potentially dangerous object"
Another thing is the system restore seems to be handicapped. While it shows bold days for save points in the past on many days I can not access them, it only displays the most recent one which is when the malware kicked into gear. I've run several virus checks including AVG and Panda which found add and spyware but nothing that looked like a lethal virus. The logs for Hijack and AVG are below
I'm running XP Pro SP3 - it's an OEM machine so I can't run a repair off a CD since it didn't come with a disk. Any help in sorting this is greatly appreciated!
thanks - DanD
Logfile of HijackThis v1.99.1
Scan saved at 11:54:59 PM, on 7/8/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\SWF Printer Pro\swfpagent.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Vista Start Menu\VistaStartMenu.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Dan D*****\My Documents\Downeloads from the net\VundoFix.exe
C:\Program Files\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.verizon.net/help/fios_settings…zer/Default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: sqvgnrpx - {9437C997-89E6-4B84-A745-BEFD3A910FF5} - C:\WINDOWS\sqvgnrpx.dll (file missing)
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic 6\delay.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [SWF Printer Agent] "C:\Program Files\SWF Printer Pro\swfpagent.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [StickyPassword] C:\Program Files\Sticky Password\stpass.exe
O4 - HKCU\..\Run: [Titan Backup] "C:\PROGRA~1\TITANB~1\Titanbackup.exe" /startup
O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Vista Start Menu\VistaStartMenu.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: ATI Tray Tools.lnk = C:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.exe
O4 - Startup: WireKeys.lnk = C:\Program Files\WiredPlane\WireKeys\WireKeys.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Compress Image Using Image Compressor 2008 - C:\Program Files\MasRizal\IMC2008\imcieex_compress.html
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {44226DFF-747E-4edc-B30C-78752E50CD0C} - (no file)
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1134415597281
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1152473287207
O16 - DPF: {CAFECAFE-0013-0001-0018-ABCDEFABCDEF} (JInitiator 1.3.1.18) - http://tgtoasdev1.targetsite.com:7777/form…iator/jinit.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Phoenix VCD Service (PhnxVCDService) - Phoenix Technologies Ltd. - C:\WINDOWS\system32\PhnxCDSvr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: WMDM PMSP Service - Unknown owner - C:\WINDOWS\system32\MsPMSPSv.exe (file missing)
==========================================
AVG log
"Scan ""Scan whole computer"" was finished."
"Infections found:";"23"
"Infected objects removed or healed";"23"
"Not removed or healed.";"0"
"Spyware found:";"3"
"Spyware removed:";"3"
"Not removed:";"0"
"Warnings count:";"45"
"Information count:";"0"
"Scan started:";"Tuesday, July 08, 2008, 10:53:40 AM"
"Total object scanned:";"1102686"
"Time needed:";"1 hour(s) 44 minute(s) 24 second(s) "
"Errors encountered:";"0"
"Infections"
"File";"Infection";"Result"
"C:\WINDOWS\sqvgnrpx.dll";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\WINDOWS\fdxbameg.dll";"Trojan horse Downloader.Adload.NT";"Moved to Virus Vault"
"C:\WINDOWS\wbxdpgfevkl.dll";"Trojan horse Downloader.Adload.NK";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\226[1].exe";"Trojan horse SHeur.BRPU";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\sqvgnrpx.dll";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\fdxbameg.dll";"Trojan horse Downloader.Adload.NT";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\wbxdpgfevkl.dll";"Trojan horse Downloader.Adload.NK";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\gpefaowr.exe";"Trojan horse Downloader.Adload.NI";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe:\$IG$IH$IF\egxk.exe";"Trojan horse Downloader.Adload.NA";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\149ZIZ0R\WebSoftCodecDrivern[1].exe";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\sqvgnrpx.dll";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\fdxbameg.dll";"Trojan horse Downloader.Adload.NT";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\wbxdpgfevkl.dll";"Trojan horse Downloader.Adload.NK";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\gpefaowr.exe";"Trojan horse Downloader.Adload.NI";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe:\$IG$IH$IF\egxk.exe";"Trojan horse Downloader.Adload.NA";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\Local Settings\Temporary Internet Files\Content.IE5\YOOBRLEJ\WebSoftCodecDrivern[2].exe";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\My Documents\My Music\Lime\Native.Instruments.Battery.VSTi.DXi.RTAS.v2.0.0.8.incl.KeyGen-H2O.zip:\h-niba2e.zip:\h-niba2.r03:\nibat2kg.exe";"Trojan horse Generic10.AMTZ";"Deleted"
"C:\Documents and Settings\Dan D*****\My Documents\My Music\Lime\Native.Instruments.Battery.VSTi.DXi.RTAS.v2.0.0.8.incl.KeyGen-H2O.zip:\h-niba2e.zip:\h-niba2.r03";"Trojan horse Generic10.AMTZ";"Deleted"
"C:\Documents and Settings\Dan D*****\My Documents\My Music\Lime\Native.Instruments.Battery.VSTi.DXi.RTAS.v2.0.0.8.incl.KeyGen-H2O.zip:\h-niba2e.zip";"Trojan horse Generic10.AMTZ";"Deleted"
"C:\Documents and Settings\Dan D*****\My Documents\My Music\Lime\Native.Instruments.Battery.VSTi.DXi.RTAS.v2.0.0.8.incl.KeyGen-H2O.zip";"Trojan horse Generic10.AMTZ";"Deleted"
"C:\System Volume Information\_restore{2C4EEC66-1D4D-4D88-B177-DA8A21110D8A}\RP736\A0210716.dll";"Trojan horse Downloader.Adload.NQ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{2C4EEC66-1D4D-4D88-B177-DA8A21110D8A}\RP736\A0210717.dll";"Trojan horse Downloader.Adload.NT";"Moved to Virus Vault"
"C:\System Volume Information\_restore{2C4EEC66-1D4D-4D88-B177-DA8A21110D8A}\RP736\A0210718.dll";"Trojan horse Downloader.Adload.NK";"Moved to Virus Vault"
"Spyware"
"File";"Infection";"Result"
"C:\Documents and Settings\Dan D*****\My Documents\Downeloads from the net\Cliprexdsfree.exe:\$JJ\SRSAI.exe";"Adware Generic3.HBO";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\My Documents\Downeloads from the net\Cliprexdsfree.exe:\$JJ\rkinstaller.exe";"Adware Generic.KUZ";"Moved to Virus Vault"
"C:\Documents and Settings\Dan D*****\My Documents\Downeloads from the net\Cliprexdsfree.exe";"Adware Generic3.HBO";"Moved to Virus Vault"
"Warnings"
"File";"Infection";"Result"
"C:\Documents and Settings\Dan D*****\Cookies\dan_D*****@2o7[2].txt:\2o7.net.bab0b6da";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Cookies\dan_D*****@2o7[2].txt";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\udtxushj.default\cookies-1.txt";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\save\udtxushj.default\cookies-1.txt";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\xz2n3ls4.Default User\cookies-1.txt";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\adrevolver.com.9b9d670a";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\adrevolver.com.f6cfcad4";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\media.adrevolver.com.5fed601d";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\yadro.ru.c77afad5";"Found Tracking cookie.Yadro";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.607ec6d0";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.574ccbf5";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.e0ebdba8";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.4fb72cc";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statcounter.com.be71625c";"Found Tracking cookie.Statcounter";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\stat.dealtime.com.f58c396a";"Found Tracking cookie.Dealtime";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\2o7.net.484dbb69";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\2o7.net.7c5cd6ef";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\searchportal.information.com.3a8d7204";"Found Tracking cookie.Information";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\tribalfusion.com.dcc03271";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt:\burstnet.com.a3218a37";"Found Tracking cookie.Burstnet";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies.txt";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\Mozilla\Firefox\Profiles\2alue99h.Ding\cookies-1.txt";"Found Tracking cookie.Webtrendslive";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt:\fastclick.net.9b41aa53";"Found Tracking cookie.Fastclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt:\fastclick.net.bb8bcae";"Found Tracking cookie.Fastclick";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt:\trafficmp.com.e56c223c";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Dan D*****\Application Data\eMusic\eMusic Download Manager\Profiles\p1dkklkg.default\cookies.txt";"Found Tracking cookie.Fastclick";"Potentially dangerous object"
