Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Look at myHJT log... please

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Look at myHJT log... please

Unread postby skinton » February 4th, 2007, 3:09 pm

We had some friends over and their kids were on the wife's computer and now there are all kinds of pop-ups. Can someone please take a look and see if they can identify my problems.

Here is the latest HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 1:51:12 PM, on 2/4/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\IA\command.exe
C:\WINNT\System32\svchosts.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Common Files\{F07B1252-050F-1033-0919-010129200001}\Update.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_A10IC2.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: Zango Search Assistant Helper /fleok=1D8A83A5C5EC137A91A475760EA83FA5EF80752B94E2DF7D5D7C442836C3 - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\program files\zango\zangohook.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{307B1~1\888Bar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{307B1~1\888Bar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SMSI Loader] C:\Program Files\Common Files\Smith Micro Shared\FAX\SMLoader.exe /PRNDRV
O4 - HKLM\..\Run: [zango] "c:\program files\zango\zango.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
O4 - HKLM\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - HKLM\..\Run: [{F07B1252-050F-1033-0919-010129200001}] "C:\Program Files\Common Files\{F07B1252-050F-1033-0919-010129200001}\Update.exe" te-110-12-0000104
O4 - HKCU\..\Run: [EPSON Stylus C60 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_A10IC2.EXE /A "C:\WINNT\System32\E_S6E.tmp"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI Multimedia\main\ATISched.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packa ... anager.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info.ap ... sSetup.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 3959027171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3959010078
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {AFDD01B0-7ABB-11D9-9669-0800200C9A66} (MFInstall Class) - http://c.ancestry.com/MFInstall/MFInstall.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/w ... der_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\IA\command.exe
O23 - Service: COM+ Messages - Unknown owner - C:\WINNT\System32\svchosts.exe" -e te-110-12-0000104 (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing)
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio
Advertisement
Register to Remove

Unread postby Kimberly » February 4th, 2007, 3:22 pm

Hello Shane,

You've got some nasty things on board, one is a file infector. I'll post back in about 1 hour or so with instructions for cleanup as I have to do a couple of things at home first. Try to keep the PC offline for the moment please.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby Kimberly » February 4th, 2007, 3:26 pm

In meanwhile, Run this please.

http://noahdfear.geekstogo.com/FindAWF.exe

Save to desktop and run. Output is to awf.txt - Post the log please.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

AWF.TXT file

Unread postby skinton » February 4th, 2007, 3:48 pm

Find AWF report by noahdfear ©2006


21504 byte files found
~~~~~~~~~~~~~



21504 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



25600 byte files found
~~~~~~~~~~~~~



25600 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



26450 byte files found
~~~~~~~~~~~~~



26450 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



bak folders found
~~~~~~~~~~~


Directory of C:\WINNT\BAK

03/06/2002 10:08 AM 40,960 GWMDMpi.exe
1 File(s) 40,960 bytes

Directory of C:\OEMDRVRS\KEYB\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\AGEIAT~1\BAK

06/12/2006 02:43 PM 335,872 TrayIcon.exe
1 File(s) 335,872 bytes

Directory of C:\PROGRA~1\ITUNES\BAK

12/18/2004 12:20 AM 278,528 iTunesHelper.exe
1 File(s) 278,528 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\MIF2B0~1\BAK

10/05/2001 07:34 PM 24,576 wkfud.exe
08/23/2001 04:52 PM 331,830 WksSb.exe
2 File(s) 356,406 bytes

Directory of C:\PROGRA~1\MSNMES~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\NORTON~1\BAK

02/27/2002 11:27 AM 75,384 navapw32.exe
1 File(s) 75,384 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

02/21/2005 07:05 PM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of C:\PROGRA~1\SYMNET~1\BAK

05/08/2000 09:23 AM 100,056 SNDMon.exe
1 File(s) 100,056 bytes

Directory of C:\PROGRA~1\ZANGO\BAK

09/16/2006 06:07 PM 908,288 zango.exe
1 File(s) 908,288 bytes

Directory of C:\WINNT\SYSTEM32\BAK

01/31/2002 07:35 AM 90,112 hkcmd.exe
01/31/2002 07:36 AM 143,360 igfxtray.exe
2 File(s) 233,472 bytes

Directory of C:\PROGRA~1\ATIMUL~1\MAIN\BAK

01/28/2002 01:00 PM 28,672 ATISched.EXE
05/02/2002 08:57 AM 98,304 LaunchPd.exe
2 File(s) 126,976 bytes

Directory of C:\PROGRA~1\ATIMUL~1\REMCTRL\BAK

10/22/2002 10:55 AM 159,744 ATIX10.exe
1 File(s) 159,744 bytes

Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK

0 File(s) 0 bytes


02/28/2002 08:47 AM 675,840 DirectCD.exe
1 File(s) 675,840 bytes

Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK

08/16/2001 11:41 PM 28,738 WkUFind.exe
1 File(s) 28,738 bytes

Directory of C:\PROGRA~1\COMMON~1\SMITHM~1\FAX\BAK

06/18/1999 02:00 PM 32,768 SMLoader.exe
1 File(s) 32,768 bytes

Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\BAK

11/02/2004 04:59 PM 218,240 UsrPrmpt.exe
1 File(s) 218,240 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~2.0_0\BIN\BAK

11/10/2005 01:03 PM 36,975 jusched.exe
1 File(s) 36,975 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

40960 Mar 6 2002 "C:\OEMDRVRS\GWMDMPI.EXE"
25600 Oct 10 2006 "C:\WINNT\GWMDMpi.exe"
40960 Mar 6 2002 "C:\WINNT\bak\GWMDMpi.exe"
25600 Oct 10 2006 "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
335872 Jun 12 2006 "C:\Program Files\AGEIA Technologies\bak\TrayIcon.exe"
25600 Oct 10 2006 "C:\Program Files\iTunes\iTunesHelper.exe"
278528 Dec 18 2004 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
25600 Oct 10 2006 "C:\Program Files\Microsoft Works\wkfud.exe"
24576 Oct 5 2001 "C:\Program Files\Microsoft Works\bak\wkfud.exe"
25600 Oct 10 2006 "C:\Program Files\Microsoft Works\WksSb.exe"
331830 Aug 23 2001 "C:\Program Files\Microsoft Works\bak\WksSb.exe"
25600 Oct 10 2006 "C:\Program Files\Norton AntiVirus\navapw32.exe"
75384 Feb 27 2002 "C:\Program Files\Norton AntiVirus\bak\navapw32.exe"
25600 Oct 10 2006 "C:\Program Files\QuickTime\qttask.exe"
98304 Feb 21 2005 "C:\Program Files\QuickTime\bak\qttask.exe"
25600 Oct 10 2006 "C:\Program Files\SymNetDrv\SNDMon.exe"
100056 May 8 2000 "C:\Program Files\SymNetDrv\bak\SNDMon.exe"
25600 Oct 10 2006 "C:\Program Files\Zango\zango.exe"
908288 Sep 16 2006 "C:\Program Files\Zango\bak\zango.exe"
90112 Jan 31 2002 "C:\OEMDRVRS\HKCMD.EXE"
25600 Oct 10 2006 "C:\WINNT\system32\hkcmd.exe"
90112 Jan 31 2002 "C:\WINNT\system32\bak\hkcmd.exe"
143360 Jan 31 2002 "C:\OEMDRVRS\IGFXTRAY.EXE"
25600 Oct 10 2006 "C:\WINNT\system32\igfxtray.exe"
143360 Jan 31 2002 "C:\WINNT\system32\bak\igfxtray.exe"
25600 Oct 10 2006 "C:\Program Files\ATI Multimedia\main\ATISched.EXE"
28672 Jan 28 2002 "C:\Program Files\ATI Multimedia\main\bak\ATISched.EXE"
25600 Oct 10 2006 "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
98304 May 2 2002 "C:\Program Files\ATI Multimedia\main\bak\LaunchPd.exe"
25600 Oct 10 2006 "C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe"
159744 Oct 22 2002 "C:\Program Files\ATI Multimedia\RemCtrl\bak\ATIX10.exe"
25600 Oct 10 2006 "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
675840 Feb 28 2002 "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\bak\DirectCD.exe"
25600 Oct 10 2006 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
28738 Aug 16 2001 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe"
25600 Oct 10 2006 "C:\Program Files\Common Files\Smith Micro Shared\Fax\SMLoader.exe"
32768 Jun 18 1999 "C:\Program Files\Common Files\Smith Micro Shared\Fax\bak\SMLoader.exe"
25600 Oct 10 2006 "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
218240 Nov 2 2004 "C:\Program Files\Common Files\Symantec Shared\Security Center\bak\UsrPrmpt.exe"
36975 Jun 3 2005 "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe"
25600 Oct 10 2006 "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe"


end of report
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

Unread postby Kimberly » February 4th, 2007, 5:44 pm

Hello Shane,

A long list of things to do ... but PC will feel better afterwards. ;)

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Stay away from Internet until the point where I ask you to post logs.
______________________________

Download http://www.mvps.org/winhelp2002/DelDomains.inf and place it on desktop

Download: ResetProtocolDefaults.reg
http://www.mvps.org/winhelp2002/ResetPr ... faults.reg

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Download SDFix and save it to your Desktop.
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
______________________________

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
______________________________

Please download Brute Force Uninstaller to your desktop.
  • Right click the BFU folder on your desktop, and choose Extract All
  • Click "Next"
  • In the box to choose where to extract the files to,
  • Click "Browse"
  • Click on the + sign next to "My Computer"
  • Click on "Local Disk (C:) or whatever your primary drive is
  • Click "Make New Folder"
  • Type in BFU
  • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).
______________________________

Copy/paste the following text into a new Notepad document.

@echo off
if exist "C:\WINNT\GWMDMpi.exe" del /q "C:\WINNT\GWMDMpi.exe"
copy /y "C:\WINNT\bak\GWMDMpi.exe" "C:\WINNT\GWMDMpi.exe"
if exist "C:\Program Files\AGEIA Technologies\TrayIcon.exe" del /q "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
copy /y "C:\Program Files\AGEIA Technologies\bak\TrayIcon.exe" "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
if exist "C:\Program Files\iTunes\iTunesHelper.exe" del /q "C:\Program Files\iTunes\iTunesHelper.exe"
copy /y "C:\Program Files\iTunes\bak\iTunesHelper.exe" "C:\Program Files\iTunes\iTunesHelper.exe"
if exist "C:\Program Files\Microsoft Works\wkfud.exe" del /q "C:\Program Files\Microsoft Works\wkfud.exe"
copy /y "C:\Program Files\Microsoft Works\bak\wkfud.exe" "C:\Program Files\Microsoft Works\wkfud.exe"
if exist "C:\Program Files\Microsoft Works\WksSb.exe" del /q "C:\Program Files\Microsoft Works\WksSb.exe"
copy /y "C:\Program Files\Microsoft Works\bak\WksSb.exe" "C:\Program Files\Microsoft Works\WksSb.exe"
if exist "C:\Program Files\Norton AntiVirus\navapw32.exe" del /q "C:\Program Files\Norton AntiVirus\navapw32.exe"
copy /y "C:\Program Files\Norton AntiVirus\bak\navapw32.exe" "C:\Program Files\Norton AntiVirus\navapw32.exe"
if exist "C:\Program Files\QuickTime\qttask.exe" del /q "C:\Program Files\QuickTime\qttask.exe"
copy /y "C:\Program Files\QuickTime\bak\qttask.exe" "C:\Program Files\QuickTime\qttask.exe"
if exist "C:\Program Files\SymNetDrv\SNDMon.exe" del /q "C:\Program Files\SymNetDrv\SNDMon.exe"
copy /y "C:\Program Files\SymNetDrv\bak\SNDMon.exe" "C:\Program Files\SymNetDrv\SNDMon.exe"
if exist "C:\WINNT\system32\hkcmd.exe" del /q "C:\WINNT\system32\hkcmd.exe"
copy /y "C:\WINNT\system32\bak\hkcmd.exe" "C:\WINNT\system32\hkcmd.exe"
if exist "C:\WINNT\system32\igfxtray.exe" del /q "C:\WINNT\system32\igfxtray.exe"
copy /y "C:\WINNT\system32\bak\igfxtray.exe" "C:\WINNT\system32\igfxtray.exe"
if exist "C:\Program Files\ATI Multimedia\main\ATISched.EXE" del /q "C:\Program Files\ATI Multimedia\main\ATISched.EXE"
copy /y "C:\Program Files\ATI Multimedia\main\bak\ATISched.EXE" "C:\Program Files\ATI Multimedia\main\ATISched.EXE"
if exist "C:\Program Files\ATI Multimedia\main\LaunchPd.exe" del /q "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
copy /y "C:\Program Files\ATI Multimedia\main\bak\LaunchPd.exe" "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
if exist "C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe" del /q "C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe"
copy /y "C:\Program Files\ATI Multimedia\RemCtrl\bak\ATIX10.exe" "C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe"
if exist "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" del /q "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
copy /y "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\bak\DirectCD.exe" "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
if exist "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" del /q "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
copy /y "C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe" "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
if exist "C:\Program Files\Common Files\Smith Micro Shared\Fax\SMLoader.exe" del /q "C:\Program Files\Common Files\Smith Micro Shared\Fax\SMLoader.exe"
copy /y "C:\Program Files\Common Files\Smith Micro Shared\Fax\bak\SMLoader.exe" "C:\Program Files\Common Files\Smith Micro Shared\Fax\SMLoader.exe"
if exist "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" del /q "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
copy /y "C:\Program Files\Common Files\Symantec Shared\Security Center\bak\UsrPrmpt.exe" "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
if exist "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" del /q "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
copy /y "C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe" "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"


Save it to your desktop as cleanme.bat. Save it as:
File Type: All Files (not as a text document or it wont work).
Name: cleanme.bat
______________________________

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
______________________________

Please go to Start > My Computer and navigate to the C:\BFU folder.
  • Start the Brute Force Uninstaller by doubleclicking BFU.exe
  • Behind the scriptline to execute field click the folder icon Image and select alcanshorty.bfu
  • Press Execute and let the program do it’s job. (You ought to see a progress bar if you did this correctly.)
  • Wait for the complete script execution box to pop up and press OK.
  • Press exit to terminate the BFU program.
SDFix
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons loaded, the SDFix report will open on screen and will also be saved into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum). Close it for now.
______________________________

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
______________________________

Double click cleanme.bat on your desktop. A CMD window will open / close, this is normal.
______________________________

Double-click SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________

Run HijackThis, click on None of the above, just start the program, click on Scan. Put a check in the box on the left side of the following items if still present:

O2 - BHO: Zango Search Assistant Helper /fleok=1D8A83A5C5EC137A91A475760EA83FA5EF80752B94E2DF7D5D7C442836C3 - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\program files\zango\zangohook.dll
O2 - BHO: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{307B1~1\888Bar.dll
O3 - Toolbar: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{307B1~1\888Bar.dll
O4 - HKLM\..\Run: [zango] "c:\program files\zango\zango.exe"
O4 - HKLM\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - HKLM\..\Run: [{F07B1252-050F-1033-0919-010129200001}] "C:\Program Files\Common Files\{F07B1252-050F-1033-0919-010129200001}\Update.exe" te-110-12-0000104
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/w ... der_v6.cab
O20 - AppInit_DLLs:
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\IA\command.exe
O23 - Service: COM+ Messages - Unknown owner - C:\WINNT\System32\svchosts.exe" -e te-110-12-0000104 (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

Close ALL windows and browsers except HijackThis and click Fix Checked
______________________________

Using Windows Explorer, Search and Delete these Folders if listed:

C:\Program Files\Ipwindows
c:\program files\zango
C:\Program Files\Network Monitor
C:\Program Files\Common Files\{F07B1252-050F-1033-0919-010129200001}
C:\program files\COMMON files\{307B1 <--- folder starts with {307B1
C:\WINNT\IA

Navigate to C:\WINNT\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Clean out your Temporary Internet files. Proceed like this:

Quit Internet Explorer, all browsers and quit any instances of Windows Explorer.

For Internet Explorer 7
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete... under Browsing History.
  • Next to Temporary Internet Files, click Delete files, and then click OK.
  • Next to Cookies, click Delete cookies, and then click OK.
  • Next to History, click Delete history, and then click OK.
  • Click the Close button.
  • Click OK.
For Internet Explorer 4.x - 6.x
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box, and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
For Netscape 4.x and Up
  • Click Edit from the Netscape menubar.
  • Click Preferences... from the Edit menu.
  • Expand the Advanced menu by clicking the triangle sign.
  • Click Cache.
  • Click both the Clear Memory Cache and the Clear Disk Cache buttons.
For Mozilla 1.x and Up
  • Click Edit from the Mozilla menubar.
  • Click Preferences... from the Edit menu.
  • Expand the Advanced menu by clicking the plus sign.
  • Click Cache.
  • Click the Clear Cache button.
For Opera
  • Click File from the Opera menubar.
  • Click Preferences... from the File menu.
  • Click the History and Cache menu.
  • Click the two Clear buttons next to Typed in addresses and Visited addresses (history) and click the Empty now button to clear the Disk cache.
  • Click Ok to close the Preferences menu.
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      Image
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
______________________________

Locate DelDomains.inf on your desktop right click the file and select install, that will reset the zone settings that have been altered.

Locate "ResetProtocolDefaults.reg"
Right-click and select: Merge (Ok the prompt)
______________________________

Copy/paste the following quote box into a new notepad (not wordpad) document. Make sure that wordwrap is turned off.

cd %systemdrive%\
If not exist lsafiles MkDir lsafiles
regedit /a /e lsafiles\1.txt HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
regedit /a /e lsafiles\2.txt HKEY_CURRENT_USER\Software\Microsoft\OLE
regedit /a /e lsafiles\3.txt HKEY_CURRENT_USER\System\CurrentControlSet\Control\Lsa
regedit /a /e lsafiles\4.txt HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
regedit /a /e lsafiles\5.txt HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
regedit /e /a lsafiles\6.txt HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet\Control\Lsa
regedit /a /e lsafiles\7.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center"
regedit /a /e lsafiles\8.txt "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center"
Regedit /a /e lsafiles\9.txt HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
Regedit /a /e lsafiles\10.txt HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
Regedit /a /e lsafiles\11.txt HKEY_LOCAL_MACHINE\SOFTWARE\Policies\WindowsFirewall
Regedit /a /e lsafiles\12.txt HKEY_CURRENT_USER\SOFTWARE\Policies\WindowsFirewall
regedit /a /e lsafiles\13.txt HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters
regedit /a /e lsafiles\14.txt HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings
regedit /a /e lsafiles\15.txt HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
regedit /a /e lsafiles\16.txt HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsUpdate
regedit /a /e lsafiles\17.txt "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore"
regedit /a /e lsafiles\18.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore"
regedit /a /e lsafiles\19.txt HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr
Copy lsafiles\*.txt = %systemdrive%\lsa.txt
rmdir /s /q lsafiles
Notepad %systemdrive%\lsa.txt


Save it to your Desktop as inspect.bat. Save it as:
File Type: All Files (not as a text document or it wont work).
Name: inspect.bat

Locate inspect.bat on your Desktop and double-click it. When finished it will open a file in Notepad. That file will be named lsa.txt. Copy/paste the content in your reply. When you close Notepad the CMD window will close automatically and the new folder will be deleted.
______________________________

Please post:
  1. c:\SDfix\Report.txt
  2. c:\rapport.txt
  3. AVG log
  4. c:\lsa.txt
  5. A new HijackThis log
Your may need several replies to post the requested logs, otherwise they might get cut off.
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

SDFix report

Unread postby skinton » February 4th, 2007, 8:05 pm

SDFix: Version 1.63

Sun 02/04/2007 - 17:18:01.20

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
COM+ Messages

Path:
"C:\WINNT\System32\svchosts.exe" -e te-110-12-0000104

COM+ Messages Deleted

Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINNT\system32\svchosts.exe - Deleted
C:\WINNT\system32\unsvchosts.lzma - Deleted



ADS Check:

C:\WINNT\system32
No streams found.

Final Check:

Remaining Services:
------------------



Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip


Checking For Files with Hidden Attributes :

C:\Program Files\Common Files\aolshare\shell\us\shellext.dll
C:\WINNT\IA\asappsrv.dll
C:\Program Files\America Online 7.0\aolphx.exe
C:\Program Files\America Online 7.0\aoltray.exe
C:\Program Files\America Online 7.0\RBM.exe
C:\Program Files\America Online 7.0\waol.exe
C:\Program Files\America Online 7.0\COMIT\cswitch.exe
C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe
C:\Program Files\Online Services\AOL70US.exe
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041822.exe
C:\WINNT\IA\command.exe
C:\hiberfil.sys
C:\Program Files\ATI Multimedia\RemCtrl\x10prod.sys
C:\Documents and Settings\Owner\Application Data\Microsoft\Word\~WRL1494.tmp

Finished
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

rapport.txt

Unread postby skinton » February 4th, 2007, 8:06 pm

SmitFraudFix v2.138

Scan done at 17:35:22.60, Sun 02/04/2007
Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Documents and Settings\Owner\Application Data\Install.dat Deleted
C:\Program Files\SpySheriff\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

AVG log

Unread postby skinton » February 4th, 2007, 8:08 pm

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 6:53:24 PM 2/4/2007

+ Scan result:



HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller.1 -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041822.exe -> Adware.ClickSpring : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041875.exe -> Adware.ClickSpring : Cleaned with backup (quarantined).
C:\WINNT\IA\asappsrv.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\WINNT\IA\command.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP969\A0041880.dll -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP969\A0041881.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041920.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041923.dll -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041924.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP943\A0041780.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041819.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041820.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP946\A0041831.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP947\A0041834.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP953\A0041839.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP955\A0041842.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP957\A0041846.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP957\A0041847.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP957\A0041848.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041858.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP984\A0041899.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Clickspring -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\WINNT\lycos.exe -> Adware.Sidesearch : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-2079644369-429115175-1203367206-1003\Dc125\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-2079644369-429115175-1203367206-1003\Dc131\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-2079644369-429115175-1203367206-1003\Dc131\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-2079644369-429115175-1203367206-1003\Dc132\888Bar.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\HJT\backups\backup-20070204-175122-946.dll -> Adware.Solution : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041977.dll -> Adware.Solution : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\ClientAX.dll -> Adware.Solution : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041868.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041869.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041870.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041871.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041872.exe -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041825.dll -> Adware.TargetServer : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent -> Adware.Zango : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent.1 -> Adware.Zango : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent\CLSID -> Adware.Zango : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent\CurVer -> Adware.Zango : Cleaned with backup (quarantined).
HKLM\SOFTWARE\zango -> Adware.Zango : Cleaned with backup (quarantined).
HKU\S-1-5-21-2079644369-429115175-1203367206-1003\Software\zango -> Adware.Zango : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Smith Micro Shared\Fax\SMLoader.exe1158464699 -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-2079644369-429115175-1203367206-1003\Dc130\zango.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041955.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041956.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041957.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041958.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041959.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041960.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041961.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041962.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041963.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041964.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041965.EXE -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041966.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041967.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041968.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041969.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041970.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041971.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041972.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041931.exe -> Downloader.Agent.bca : Cleaned with backup (quarantined).
C:\Documents and Settings\cedes #1player\Local Settings\Temporary Internet Files\Content.IE5\7AB6NBIC\checkin[10].htm -> Downloader.Small.co : Cleaned with backup (quarantined).
C:\Documents and Settings\shane\Local Settings\Temporary Internet Files\Content.IE5\LB3DZ1JO\l[1].php -> Downloader.Small.co : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041921.dll -> Downloader.Small.ece : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041814.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041824.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041823.exe -> Downloader.TSUpdate.n : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP945\A0041813.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041922.exe -> Dropper.DollarR.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP944\A0041811.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-2079644369-429115175-1203367206-1003\Dc125\system.dll -> Logger.Delf.mk : Cleaned with backup (quarantined).
C:\HJT\backups\backup-20070204-175122-529.dll -> Not-A-Virus.Downloader.Win32.PopCap.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041919.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
:mozilla.10:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.11:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.12:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.13:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.14:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.15:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.6:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.6:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.7:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.7:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.8:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.9:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@heavycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [14].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [53].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@kohler.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@northwestairlines.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.8:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Abetterinternet : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [58].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [69].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@admarketplace[2].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [55].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [67].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.133:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.134:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.135:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.72:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.73:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [66].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [11].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [42].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.30:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.31:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.32:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.33:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Centrport : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@centrport[2].txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.150:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.38:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.39:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@downloads-zdnet.com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@dbbsrv[1].txt -> TrackingCookie.Dbbsrv : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [12].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@enhance[2].txt -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wfkoagdpkgo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wfkoaldzigo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wfkysgdjiho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wgkoagd5ccq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6whkiwkc5egp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wjk4wpajefp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wjkoamdjchp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wjkowjczwkp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wjkowpc5efo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wjkygld5who.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wjkyoocpwkp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wjlocjczebp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@e-2dj6wjnyuld5kgp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.25:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.60:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [27].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [38].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@ads.gamershell[1].txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@gamershell[2].txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@www.gamershell[1].txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@goclick[2].txt -> TrackingCookie.Goclick : Cleaned.
:mozilla.158:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.159:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.160:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [60].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.128:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [22].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
:mozilla.86:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.87:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.90:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [18].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [26].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@data1.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@data2.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@data4.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
:mozilla.20:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.21:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.22:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [75].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.92:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Pro-market : Cleaned.
:mozilla.93:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Pro-market : Cleaned.
:mozilla.100:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.52:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.94:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.95:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.96:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.97:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.98:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.99:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.101:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.53:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [54].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.102:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.103:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.54:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.55:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [68].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.21:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.22:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.53:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.54:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [73].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.81:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@h.starware[2].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@try.starware[1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.115:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.116:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.117:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.139:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.122:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.62:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [49].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@reduxads.valuead[1].txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [41].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [33].txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [3].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.136:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.137:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\Shane\oe8byszv.slt\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.74:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.75:C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bs2h0gfk.slt\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [28].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\cedes #1player\Cookies\cedes #1player@cedes [30].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\shane\Cookies\shane@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\WINNT\msbbi.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined).
C:\WINNT\plande.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP943\A0041778.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP943\A0041790.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP944\A0041812.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP946\A0041833.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP947\A0041835.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP953\A0041840.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP954\A0041841.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP955\A0041843.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP956\A0041844.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041856.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041866.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041918.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINNT\IA\KE.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINNT\system32\wnstssv.exe -> Trojan.Small : Cleaned with backup (quarantined).


::Report end
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

lsa.txt

Unread postby skinton » February 4th, 2007, 8:09 pm

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum]
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"=dword:00000001
"{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}"=dword:40000021
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"=dword:00000020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,\
33,32,5c,69,70,6e,61,74,68,6c,70,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000
"CreateFirstRunRp"=dword:00000001
"DSMin"=dword:000000c8
"DSMax"=dword:00000190
"RPSessionInterval"=dword:00000000
"RPGlobalInterval"=dword:00015180
"RPLifeInterval"=dword:0076a700
"CompressionBurst"=dword:0000003c
"TimerInterval"=dword:00000078
"DiskPercent"=dword:0000000c
"ThawInterval"=dword:00000384
"RestoreDiskSpaceError"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Cfg]
"DiskPercent"=dword:0000000c
"MachineGuid"="{0193FC1C-0A70-478B-8107-B531B8E70CAB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SnapshotCallbacks]
@=""

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr]
"Type"=dword:00000002
"Start"=dword:00000000
"ErrorControl"=dword:00000001
"Tag"=dword:00000004
"ImagePath"=hex(2):53,79,73,74,65,6d,33,32,5c,44,52,49,56,45,52,53,5c,73,72,2e,\
73,79,73,00
"DisplayName"="System Restore Filter Driver"
"Group"="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Parameters]
"FirstRun"=dword:00000000
"DontBackup"=dword:00000000
"MachineGuid"="{0193FC1C-0A70-478B-8107-B531B8E70CAB}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Enum]
"0"="Root\\LEGACY_SR\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,64,00,00,00,80,00,00,00,00,00,00,00,\
14,00,00,00,02,00,50,00,03,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,\
00,00,05,12,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,00,\
00,05,04,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,5f,84,1f,\
5e,2e,6b,49,ce,12,03,03,f4,01,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,\
5f,84,1f,5e,2e,6b,49,ce,12,03,03,f4,01,00,00
"EnableDCOM"="Y"

REGEDIT4

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
"Bounds"=hex:00,30,00,00,00,20,00,00
"Security Packages"=hex(7):6b,65,72,62,65,72,6f,73,00,6d,73,76,31,5f,30,00,73,\
63,68,61,6e,6e,65,6c,00,77,64,69,67,65,73,74,00,00
"LsaPid"=dword:000001fc
"SecureBoot"=dword:00000001
"auditbaseobjects"=dword:00000000
"crashonauditfail"=dword:00000000
"disabledomaincreds"=dword:00000000
"everyoneincludesanonymous"=dword:00000000
"fipsalgorithmpolicy"=dword:00000000
"forceguest"=dword:00000001
"fullprivilegeauditing"=hex:00
"limitblankpassworduse"=dword:00000001
"lmcompatibilitylevel"=dword:00000000
"nodefaultadminowner"=dword:00000001
"nolmhash"=dword:00000000
"restrictanonymous"=dword:00000000
"restrictanonymoussam"=dword:00000001
"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\AccessProviders]
"ProviderOrder"=hex(7):57,69,6e,64,6f,77,73,20,4e,54,20,41,63,63,65,73,73,20,\
50,72,6f,76,69,64,65,72,00,00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,6e,74,6d,61,72,74,61,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Data]
"Pattern"=hex:62,92,94,8f,4e,f9,68,71,fc,90,34,be,68,6d,00,47,61,63,65,64,38,\
66,31,32,00,00,00,00,01,00,00,00,b0,01,00,00,b4,01,00,00,40,ca,06,00,5b,a5,\
bf,71,04,00,00,00,10,00,00,00,00,00,00,00,04,a7,09,41

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\GBG]
"GrafBlumGroup"=hex:2e,e3,41,7f,21,16,f8,18,bf

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\JD]
"Lookup"=hex:31,06,2b,8a,03,a5

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Domains]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\SidCache]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\msv1_0]
"ntlmminclientsec"=dword:00000000
"ntlmminserversec"=dword:00000000

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Skew1]
"SkewMatrix"=hex:9c,40,41,1f,e9,86,67,ff,9a,0c,48,84,38,77,f4,78

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SSO]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache]
"Time"=hex:da,58,6d,13,62,3e,c3,01

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"
"Capabilities"=dword:00004050
"RpcId"=dword:0000ffff
"Version"=dword:00000001
"TokenSize"=dword:0000ffff
"Time"=hex:00,e5,84,8a,48,4f,c2,01
"Type"=dword:00000031

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000011
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,68,41,37,07,28,c1,01
"Type"=dword:00000031

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000012
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,4d,0e,94,48,4f,c2,01
"Type"=dword:00000031

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"DisableRegistryTools"=dword:00000000


skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

hjt log

Unread postby skinton » February 4th, 2007, 8:10 pm

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum]
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"=dword:00000001
"{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}"=dword:40000021
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"=dword:00000020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,\
33,32,5c,69,70,6e,61,74,68,6c,70,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000
"CreateFirstRunRp"=dword:00000001
"DSMin"=dword:000000c8
"DSMax"=dword:00000190
"RPSessionInterval"=dword:00000000
"RPGlobalInterval"=dword:00015180
"RPLifeInterval"=dword:0076a700
"CompressionBurst"=dword:0000003c
"TimerInterval"=dword:00000078
"DiskPercent"=dword:0000000c
"ThawInterval"=dword:00000384
"RestoreDiskSpaceError"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Cfg]
"DiskPercent"=dword:0000000c
"MachineGuid"="{0193FC1C-0A70-478B-8107-B531B8E70CAB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SnapshotCallbacks]
@=""

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr]
"Type"=dword:00000002
"Start"=dword:00000000
"ErrorControl"=dword:00000001
"Tag"=dword:00000004
"ImagePath"=hex(2):53,79,73,74,65,6d,33,32,5c,44,52,49,56,45,52,53,5c,73,72,2e,\
73,79,73,00
"DisplayName"="System Restore Filter Driver"
"Group"="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Parameters]
"FirstRun"=dword:00000000
"DontBackup"=dword:00000000
"MachineGuid"="{0193FC1C-0A70-478B-8107-B531B8E70CAB}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Enum]
"0"="Root\\LEGACY_SR\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,64,00,00,00,80,00,00,00,00,00,00,00,\
14,00,00,00,02,00,50,00,03,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,\
00,00,05,12,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,00,\
00,05,04,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,5f,84,1f,\
5e,2e,6b,49,ce,12,03,03,f4,01,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,\
5f,84,1f,5e,2e,6b,49,ce,12,03,03,f4,01,00,00
"EnableDCOM"="Y"

REGEDIT4

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
"Bounds"=hex:00,30,00,00,00,20,00,00
"Security Packages"=hex(7):6b,65,72,62,65,72,6f,73,00,6d,73,76,31,5f,30,00,73,\
63,68,61,6e,6e,65,6c,00,77,64,69,67,65,73,74,00,00
"LsaPid"=dword:000001fc
"SecureBoot"=dword:00000001
"auditbaseobjects"=dword:00000000
"crashonauditfail"=dword:00000000
"disabledomaincreds"=dword:00000000
"everyoneincludesanonymous"=dword:00000000
"fipsalgorithmpolicy"=dword:00000000
"forceguest"=dword:00000001
"fullprivilegeauditing"=hex:00
"limitblankpassworduse"=dword:00000001
"lmcompatibilitylevel"=dword:00000000
"nodefaultadminowner"=dword:00000001
"nolmhash"=dword:00000000
"restrictanonymous"=dword:00000000
"restrictanonymoussam"=dword:00000001
"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\AccessProviders]
"ProviderOrder"=hex(7):57,69,6e,64,6f,77,73,20,4e,54,20,41,63,63,65,73,73,20,\
50,72,6f,76,69,64,65,72,00,00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,6e,74,6d,61,72,74,61,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Data]
"Pattern"=hex:62,92,94,8f,4e,f9,68,71,fc,90,34,be,68,6d,00,47,61,63,65,64,38,\
66,31,32,00,00,00,00,01,00,00,00,b0,01,00,00,b4,01,00,00,40,ca,06,00,5b,a5,\
bf,71,04,00,00,00,10,00,00,00,00,00,00,00,04,a7,09,41

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\GBG]
"GrafBlumGroup"=hex:2e,e3,41,7f,21,16,f8,18,bf

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\JD]
"Lookup"=hex:31,06,2b,8a,03,a5

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Domains]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\SidCache]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\msv1_0]
"ntlmminclientsec"=dword:00000000
"ntlmminserversec"=dword:00000000

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Skew1]
"SkewMatrix"=hex:9c,40,41,1f,e9,86,67,ff,9a,0c,48,84,38,77,f4,78

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SSO]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache]
"Time"=hex:da,58,6d,13,62,3e,c3,01

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"
"Capabilities"=dword:00004050
"RpcId"=dword:0000ffff
"Version"=dword:00000001
"TokenSize"=dword:0000ffff
"Time"=hex:00,e5,84,8a,48,4f,c2,01
"Type"=dword:00000031

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000011
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,68,41,37,07,28,c1,01
"Type"=dword:00000031

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000012
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,4d,0e,94,48,4f,c2,01
"Type"=dword:00000031

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"DisableRegistryTools"=dword:00000000


skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

Unread postby Kimberly » February 4th, 2007, 11:58 pm

Hello Shane,

Looking much better. :)
Are you sure you did clean up your temporary folders in Safe Mode ? Forgot to mention it but you need to reveal hidden files. :oops:

Make sure that you can see hidden files.
  1. Click Start.
  2. Click My Computer.
  3. Select the Tools menu and click Folder Options.
  4. Select the View Tab.
  5. Under the Hidden files and folders heading select Show hidden files and folders.
  6. Uncheck the Hide protected operating system files (recommended) option.
  7. Click Yes to confirm.
  8. Uncheck the Hide file extensions for known file types.
  9. Click OK.

Double check that the folder C:\WINNT\IA has been deleted. If not delete the folder.

While you are at it, make sure these are gone too.

C:\Program Files\Ipwindows
c:\program files\zango
C:\Program Files\Network Monitor
C:\Program Files\Common Files\{F07B1252-050F-1033-0919-010129200001}
C:\program files\COMMON files\{307B1 <--- folder starts with {307B1
______________________________

Locate FindAWF.exe on your desktop and run it. Output is to awf.txt - Post the log please.
______________________________

Please do an online scan with Kaspersky Online Scanner

Notice!
A new version of Kaspersky Virus Scanner has been released on August 8, 2006. If you have installed a previous version, you must unistall that program first before installing the new version. To uninstall, please go to the computer control panel and select "Add/Remove Programs." Close all Internet Explorer windows before uninstalling the Kaspersky Online Scanner.

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Extended (If available otherwise Standard)
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save Report As button:
    • Save the file to your desktop.
    • File Type: Text file (*.txt).
    • Name: Kav.txt for example
  • Copy and paste that information in your next post.


Please post the awf log, the Kaspersky log and a fresh hijackthis log.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

awf.txt

Unread postby skinton » February 5th, 2007, 11:06 pm

Find AWF report by noahdfear ©2006


21504 byte files found
~~~~~~~~~~~~~

21504 "C:\Documents and Settings\Owner\My Documents\Backup of 10-25-04 wedding.wbk"
21504 "C:\Documents and Settings\Owner\My Documents\Backup of 10-13-04 Everybody Love Raymond.wbk"
21504 "C:\Documents and Settings\Owner\My Documents\Backup of 10-31-04 Columbus Zoo.wbk"
21504 "C:\Program Files\WildTangent\Apps\DRM0302.dll"
21504 "C:\Program Files\WildTangent\Components\wtPropertyBag0200.dll"
21504 "C:\WINNT\$hf_mig$\KB873339\update\spcustom.dll"
21504 "C:\WINNT\$hf_mig$\KB885835\update\spcustom.dll"
21504 "C:\WINNT\$hf_mig$\KB885836\update\spcustom.dll"
21504 "C:\WINNT\$hf_mig$\KB888113\update\spcustom.dll"
21504 "C:\WINNT\$hf_mig$\KB888302\update\spcustom.dll"
21504 "C:\WINNT\$hf_mig$\KB891781\update\spcustom.dll"
21504 "C:\WINNT\$hf_mig$\KB900725\SP2QFE\xpsp3res.dll"
21504 "C:\WINNT\ServicePackFiles\i386\lang\cintlgnt.ime"


21504 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



25600 byte files found
~~~~~~~~~~~~~

25600 "C:\Documents and Settings\Owner\My Documents\Backup of 10-18-04 Worlds of Wonder, Days of Judgment.wbk"
25600 "C:\Documents and Settings\Owner\My Documents\Backup of 11-12-04 familiy outline.wbk"
25600 "C:\Documents and Settings\shane\Desktop\Book2.xls"


25600 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



26450 byte files found
~~~~~~~~~~~~~



26450 byte files sorted with strings
~~~~~~~~~~~~~~~~~~~~~



bak folders found
~~~~~~~~~~~


Directory of C:\WINNT\BAK

03/06/2002 10:08 AM 40,960 GWMDMpi.exe
1 File(s) 40,960 bytes

Directory of C:\OEMDRVRS\KEYB\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\ITUNES\BAK

12/18/2004 12:20 AM 278,528 iTunesHelper.exe
1 File(s) 278,528 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\MIF2B0~1\BAK

10/05/2001 07:34 PM 24,576 wkfud.exe
08/23/2001 04:52 PM 331,830 WksSb.exe
2 File(s) 356,406 bytes

Directory of C:\PROGRA~1\MSNMES~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\NORTON~1\BAK

02/27/2002 11:27 AM 75,384 navapw32.exe
1 File(s) 75,384 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

02/21/2005 07:05 PM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of C:\PROGRA~1\SYMNET~1\BAK

05/08/2000 09:23 AM 100,056 SNDMon.exe
1 File(s) 100,056 bytes

Directory of C:\WINNT\SYSTEM32\BAK

01/31/2002 07:35 AM 90,112 hkcmd.exe
01/31/2002 07:36 AM 143,360 igfxtray.exe
2 File(s) 233,472 bytes

Directory of C:\PROGRA~1\ATIMUL~1\MAIN\BAK

01/28/2002 01:00 PM 28,672 ATISched.EXE
05/02/2002 08:57 AM 98,304 LaunchPd.exe
2 File(s) 126,976 bytes

Directory of C:\PROGRA~1\ATIMUL~1\REMCTRL\BAK

10/22/2002 10:55 AM 159,744 ATIX10.exe
1 File(s) 159,744 bytes

Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK

0 File(s) 0 bytes


02/28/2002 08:47 AM 675,840 DirectCD.exe
1 File(s) 675,840 bytes

Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK

08/16/2001 11:41 PM 28,738 WkUFind.exe
1 File(s) 28,738 bytes

Directory of C:\PROGRA~1\COMMON~1\SMITHM~1\FAX\BAK

06/18/1999 02:00 PM 32,768 SMLoader.exe
1 File(s) 32,768 bytes

Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\BAK

11/02/2004 04:59 PM 218,240 UsrPrmpt.exe
1 File(s) 218,240 bytes

Directory of C:\PROGRA~1\JAVA\JRE15~2.0_0\BIN\BAK

11/10/2005 01:03 PM 36,975 jusched.exe
1 File(s) 36,975 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

40960 Mar 6 2002 "C:\OEMDRVRS\GWMDMPI.EXE"
40960 Mar 6 2002 "C:\WINNT\GWMDMpi.exe"
40960 Mar 6 2002 "C:\WINNT\bak\GWMDMpi.exe"
278528 Dec 18 2004 "C:\Program Files\iTunes\iTunesHelper.exe"
278528 Dec 18 2004 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
24576 Oct 5 2001 "C:\Program Files\Microsoft Works\wkfud.exe"
24576 Oct 5 2001 "C:\Program Files\Microsoft Works\bak\wkfud.exe"
331830 Aug 23 2001 "C:\Program Files\Microsoft Works\WksSb.exe"
331830 Aug 23 2001 "C:\Program Files\Microsoft Works\bak\WksSb.exe"
75384 Feb 27 2002 "C:\Program Files\Norton AntiVirus\navapw32.exe"
75384 Feb 27 2002 "C:\Program Files\Norton AntiVirus\bak\navapw32.exe"
98304 Feb 21 2005 "C:\Program Files\QuickTime\qttask.exe"
98304 Feb 21 2005 "C:\Program Files\QuickTime\bak\qttask.exe"
100056 May 8 2000 "C:\Program Files\SymNetDrv\SNDMon.exe"
100056 May 8 2000 "C:\Program Files\SymNetDrv\bak\SNDMon.exe"
90112 Jan 31 2002 "C:\OEMDRVRS\HKCMD.EXE"
90112 Jan 31 2002 "C:\WINNT\system32\hkcmd.exe"
90112 Jan 31 2002 "C:\WINNT\system32\bak\hkcmd.exe"
143360 Jan 31 2002 "C:\OEMDRVRS\IGFXTRAY.EXE"
143360 Jan 31 2002 "C:\WINNT\system32\igfxtray.exe"
143360 Jan 31 2002 "C:\WINNT\system32\bak\igfxtray.exe"
28672 Jan 28 2002 "C:\Program Files\ATI Multimedia\main\ATISched.EXE"
28672 Jan 28 2002 "C:\Program Files\ATI Multimedia\main\bak\ATISched.EXE"
98304 May 2 2002 "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
98304 May 2 2002 "C:\Program Files\ATI Multimedia\main\bak\LaunchPd.exe"
159744 Oct 22 2002 "C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe"
159744 Oct 22 2002 "C:\Program Files\ATI Multimedia\RemCtrl\bak\ATIX10.exe"
675840 Feb 28 2002 "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
675840 Feb 28 2002 "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\bak\DirectCD.exe"
28738 Aug 16 2001 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
28738 Aug 16 2001 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe"
32768 Jun 18 1999 "C:\Program Files\Common Files\Smith Micro Shared\Fax\SMLoader.exe"
32768 Jun 18 1999 "C:\Program Files\Common Files\Smith Micro Shared\Fax\bak\SMLoader.exe"
218240 Nov 2 2004 "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
218240 Nov 2 2004 "C:\Program Files\Common Files\Symantec Shared\Security Center\bak\UsrPrmpt.exe"
36975 Jun 3 2005 "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe"
36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe"


end of report
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

kav.txt

Unread postby skinton » February 5th, 2007, 11:08 pm

This was not run in Safe Mode. Don't know if it matters. Safe Mode didn't have network support.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, February 05, 2002 10:01:58 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 6/02/2007
Kaspersky Anti-Virus database records: 265241
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 60165
Number of viruses found: 16
Number of infected objects: 44 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:29:07

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Desktop\computer clean up\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Owner\Desktop\computer clean up\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Owner\Desktop\computer clean up\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Owner\Desktop\computer clean up\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\Owner\Desktop\computer clean up\SmitfraudFix.exe PE_Patch.UPX: infected - 2 skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I5AH8TKF\ErrorSafeNewReleaseInstall[1].exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe/data.rar/plugin/keyfinderpe/keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe/data.rar/plugin/keyfinderpe/keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe/data.rar/plugin/keyfinderpe/keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe/data.rar/plugin/keyfinderpe/keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe/data.rar/plugin/VNCServer/vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe/data.rar/plugin/VNCServer/winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe/data.rar/plugin/VNCServer/wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe/data.rar Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
C:\Documents and Settings\shane\Desktop\New Folder\UBCD4WinV255.exe RarSFX: infected - 8 skipped
C:\Documents and Settings\shane\Local Settings\Temporary Internet Files\Content.IE5\MRSL658F\popcaploader_v6[1].cab/PopCapLoader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
C:\Documents and Settings\shane\Local Settings\Temporary Internet Files\Content.IE5\MRSL658F\popcaploader_v6[1].cab CAB: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\0E516C40.htm Infected: Trojan-Dropper.Win32.Runme skipped
C:\SDFix\backups\backups.zip/backups/svchosts.exe Infected: Trojan-Downloader.Win32.Agent.bca skipped
C:\SDFix\backups\backups.zip ZIP: infected - 1 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041862.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fl skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041862.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP960\A0041862.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP984\A0041900.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fl skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP984\A0041900.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP984\A0041900.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041973.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041973.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041973.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041973.exe PE_Patch.UPX: infected - 2 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041983.exe Infected: Trojan-Downloader.Win32.Agent.awf skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041984.dll Infected: Trojan-Spy.Win32.Delf.mk skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041987.exe/msbb.exe Infected: not-a-virus:AdWare.Win32.180Solutions skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041987.exe CAB: infected - 1 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041987.exe MimarSinan: infected - 1 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041987.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041989.exe Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041990.exe Infected: not-a-virus:AdWare.Win32.Softomate.ac skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041991.dll Infected: not-a-virus:AdWare.Win32.Softomate.ac skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041992.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041993.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041994.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041995.exe/data0004 Infected: not-a-virus:AdWare.Win32.Sidesearch.b skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP995\A0041995.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP997\change.log Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\callcont.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\gdi32.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\h323.tsp Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\h323msp.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\helpctr.exe Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\msgina.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\mst120.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\netapi32.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
C:\WINNT\$NtUninstallKB835732$\schannel.dll Object is locked skipped
C:\WINNT\Debug\oakley.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\Sti_Trace.log Object is locked skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\DEFAULT Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\SOFTWARE Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SYSTEM Object is locked skipped
C:\WINNT\system32\config\system.LOG Object is locked skipped
C:\WINNT\system32\h323log.txt Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINNT\wiadebug.log Object is locked skipped
C:\WINNT\wiaservc.log Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped

Scan process completed.
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

hijackthis.log

Unread postby skinton » February 5th, 2007, 11:10 pm

Logfile of HijackThis v1.99.1
Scan saved at 10:07:10 PM, on 2/5/2002
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\System32\SK9910DM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Smith Micro Shared\FAX\SMLoader.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_A10IC2.EXE
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
C:\Program Files\ATI Multimedia\main\ATISched.EXE
C:\WINNT\System32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\HJT\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SMSI Loader] C:\Program Files\Common Files\Smith Micro Shared\FAX\SMLoader.exe /PRNDRV
O4 - HKCU\..\Run: [EPSON Stylus C60 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_A10IC2.EXE /A "C:\WINNT\System32\E_S6E.tmp"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI Multimedia\main\ATISched.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packa ... anager.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info.ap ... sSetup.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 3959027171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3959010078
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {AFDD01B0-7ABB-11D9-9669-0800200C9A66} (MFInstall Class) - http://c.ancestry.com/MFInstall/MFInstall.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing)
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio

Unread postby skinton » February 5th, 2007, 11:15 pm

You ad mentioned to delete these folders. The ones in bold were deleted, the others were not found.

C:\Program Files\Ipwindows
c:\program files\zango
C:\Program Files\Network Monitor
C:\Program Files\Common Files\{F07B1252-050F-1033-0919-010129200001}
C:\program files\COMMON files\{307B1 <--- folder starts with {307B1
skinton
Regular Member
 
Posts: 28
Joined: December 19th, 2005, 6:11 pm
Location: Ohio
Advertisement
Register to Remove

Next

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 37 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware