Here is the spysweeper log...
********
2:33 PM: | Start of Session, Sunday, November 20, 2005 |
2:33 PM: Spy Sweeper started
2:33 PM: Sweep initiated using definitions version 574
2:33 PM: Starting Memory Sweep
2:39 PM: Memory Sweep Complete, Elapsed Time: 00:05:54
2:39 PM: Starting Registry Sweep
2:39 PM: Found Adware: apropos
2:39 PM: HKCR\clsid\{b5ab638f-d76c-415b-a8f2-f3ceac502212}\ (7 subtraces) (ID = 103726)
2:39 PM: HKCR\clsid\{bc333116-6ea1-40a1-9d07-ecb192db8cea}\ (4 subtraces) (ID = 103729)
2:39 PM: HKLM\software\classes\clsid\{b5ab638f-d76c-415b-a8f2-f3ceac502212}\ (7 subtraces) (ID = 103764)
2:39 PM: HKLM\software\classes\clsid\{bc333116-6ea1-40a1-9d07-ecb192db8cea}\ (4 subtraces) (ID = 103767)
2:39 PM: HKLM\software\classes\interface\{bc333116-6ea1-40a1-9d07-ecb192db8cea}\ (5 subtraces) (ID = 103774)
2:40 PM: Found Adware: cws-aboutblank
2:40 PM: HKLM\software\microsoft\windows\currentversion\uninstall\searchassistant uninstall\ (2 subtraces) (ID = 116768)
2:40 PM: Found Adware: dealhelper
2:40 PM: HKLM\software\microsoft\windows\currentversion\uninstall\windh\ (3 subtraces) (ID = 124816)
2:40 PM: Found Adware: instant access
2:40 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/system/egdial.dll\ (2 subtraces) (ID = 128797)
2:40 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\system\egdial.dll (ID = 128831)
2:40 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\system\ia.dll (ID = 128832)
2:41 PM: Found Adware: powerscan
2:41 PM: HKLM\software\powerscan\ (ID = 136824)
2:41 PM: Found Adware: purityscan
2:41 PM: HKLM\software\clickspring\ (2 subtraces) (ID = 137699)
2:41 PM: Found Adware: surfsidekick
2:41 PM: HKU\.default\software\surfsidekick3\ (3 subtraces) (ID = 143387)
2:41 PM: HKCR\clsid\{02ee5b04-f144-47bb-83fb-a60bd91b74a9}\ (3 subtraces) (ID = 143389)
2:41 PM: HKLM\software\classes\clsid\{02ee5b04-f144-47bb-83fb-a60bd91b74a9}\ (3 subtraces) (ID = 143392)
2:41 PM: HKLM\software\microsoft\internet explorer\urlsearchhooks\ || {02ee5b04-f144-47bb-83fb-a60bd91b74a9} (ID = 143400)
2:41 PM: HKLM\software\surfsidekick3\ (2 subtraces) (ID = 143413)
2:41 PM: Found Adware: ist yoursitebar
2:41 PM: HKCR\clsid\{42f2c9ba-614f-47c0-b3e3-ecfd34eed658}\ (11 subtraces) (ID = 147829)
2:41 PM: HKCR\interface\{90ce74cc-788a-4a00-b38d-cbca08cc9e8f}\ (8 subtraces) (ID = 147833)
2:41 PM: HKLM\software\classes\interface\{90ce74cc-788a-4a00-b38d-cbca08cc9e8f}\ (8 subtraces) (ID = 147839)
2:41 PM: HKLM\software\classes\typelib\{cc257918-f435-4a33-8231-2b8195990cca}\ (9 subtraces) (ID = 147843)
2:41 PM: HKLM\software\classes\ysbactivex.installer.1\ (3 subtraces) (ID = 147848)
2:41 PM: HKLM\software\classes\ysbactivex.installer\ (5 subtraces) (ID = 147849)
2:41 PM: Found Adware: ist software
2:41 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/ysbactivex.dll\ (2 subtraces) (ID = 147854)
2:41 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\ysbactivex.dll (ID = 147857)
2:41 PM: HKLM\software\yoursitebar\ (14 subtraces) (ID = 147860)
2:41 PM: HKCR\typelib\{cc257918-f435-4a33-8231-2b8195990cca}\ (9 subtraces) (ID = 147862)
2:41 PM: HKCR\ysbactivex.installer.1\ (3 subtraces) (ID = 147867)
2:41 PM: HKCR\ysbactivex.installer.1\clsid\ (1 subtraces) (ID = 147868)
2:41 PM: HKCR\ysbactivex.installer\ (5 subtraces) (ID = 147869)
2:41 PM: HKLM\software\ddate\ (1 subtraces) (ID = 636618)
2:41 PM: Found Adware: command
2:41 PM: HKLM\software\microsoft\windows\currentversion\uninstall\{3877c2cd-f137-4144-bdb2-0a811492f920}\ (7 subtraces) (ID = 892523)
2:41 PM: HKLM\software\classes\clsid\{42f2c9ba-614f-47c0-b3e3-ecfd34eed658}\ (11 subtraces) (ID = 920458)
2:41 PM: Found Adware: whenu searchbar/pricebandit
2:41 PM: HKCR\applications\whse.exe\ (3 subtraces) (ID = 999727)
2:41 PM: HKLM\software\classes\applications\whse.exe\ (3 subtraces) (ID = 999741)
2:42 PM: HKU\.DEFAULT\software\microsoft\windows\currentversion\wintrust\trust providers\software publishing\trust database\0\ || goicfboogidikkejccmclpieicihhlpo bgdjdn (ID = 128845)
2:42 PM: Found Adware: ist sidefind
2:42 PM: HKU\.DEFAULT\software\microsoft\internet explorer\extensions\cmdmapping\ || {10e42047-deb9-4535-a118-b3f6ec39b807} (ID = 141778)
2:42 PM: HKU\.DEFAULT\software\surfsidekick3\ (3 subtraces) (ID = 143412)
2:42 PM: Found Trojan Horse: trojan-downloader-pacisoft
2:42 PM: HKU\.DEFAULT\software\apd123\ (10 subtraces) (ID = 861435)
2:42 PM: Found Adware: showbehind
2:42 PM: HKU\.DEFAULT\software\showbehind\ (ID = 980567)
2:42 PM: Registry Sweep Complete, Elapsed Time:00:02:30
2:42 PM: Starting Cookie Sweep
2:42 PM: Found Spy Cookie: atwola cookie
2:42 PM: steventhebol@atwola[1].txt (ID = 2255)
2:42 PM: Found Spy Cookie: 2o7.net cookie
2:42 PM: steventhebol@msnportal.112.2o7[1].txt (ID = 1958)
2:42 PM: steventhebol@2o7[1].txt (ID = 1957)
2:42 PM: Found Spy Cookie: maxserving cookie
2:42 PM: steventhebol@maxserving[1].txt (ID = 2966)
2:42 PM: Found Spy Cookie: trafficmp cookie
2:42 PM: steventhebol@trafficmp[2].txt (ID = 3581)
2:42 PM: Found Spy Cookie: yieldmanager cookie
2:42 PM:
steventhebol@ad.yieldmanager[1].txt (ID = 3751)
2:42 PM: Found Spy Cookie: cc214142 cookie
2:42 PM:
steventhebol@ads.cc214142[2].txt (ID = 2367)
2:42 PM: Found Spy Cookie: tribalfusion cookie
2:42 PM: steventhebol@tribalfusion[1].txt (ID = 3589)
2:42 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01
2:42 PM: Starting File Sweep
2:42 PM: Warning: Failed to open file "c:\windows\win386.swp". The process cannot access the file because it is being used by another process
2:42 PM: Found Adware: bookedspace
2:42 PM: bxxs5.dll (ID = 51656)
2:42 PM: bsx32.ini (ID = 51653)
2:42 PM: atmtd.dll (ID = 166754)
2:42 PM: atmtd.dll._ (ID = 166754)
2:43 PM: Found Adware: sexfiles dialers
2:43 PM: dating.lnk (ID = 75396)
2:44 PM: Found Adware: wurldmedia
2:44 PM: moconfig.exe (ID = 90743)
2:44 PM: ia.dll (ID = 63845)
2:44 PM: ssk3.exe (ID = 115260)
2:44 PM: Found Adware: isearch toolbar
2:44 PM: mte2odm6odoxng.exe (ID = 145831)
2:44 PM: Found Adware: marketscore
2:44 PM: rlls.dll (ID = 159066)
2:44 PM: rk.bin (ID = 159065)
2:44 PM: rlvknlg.exe (ID = 159065)
2:44 PM: Found Adware: ezula ilookup
2:44 PM: fran-hot.exe (ID = 180418)
2:44 PM: Found Adware: virtualbouncer
2:44 PM: vb2.exe (ID = 164842)
2:44 PM: Found Trojan Horse: 2nd-thought
2:44 PM: c:\windows\system\newmsrdk (1 subtraces) (ID = -2147481534)
2:45 PM: Warning: Failed to open file "c:\windows\all users\application data\aol\c_america online 9.0a\idb\style.lst". The process cannot access the file because it is being used by another process
2:45 PM: Warning: Failed to open file "c:\windows\all users\application data\aol\c_america online 9.0a\idb\main.idx". The process cannot access the file because it is being used by another process
2:45 PM: Warning: Failed to open file "c:\windows\all users\application data\aol\c_america online 9.0a\idb\sysnews.lst". The process cannot access the file because it is being used by another process
2:45 PM: Warning: Failed to open file "c:\windows\all users\application data\aol\c_america online 9.0a\idb\toolbar.lst". The process cannot access the file because it is being used by another process
2:45 PM: Warning: Failed to open file "c:\windows\all users\application data\aol\c_america online 9.0a\idb\apps.lst". The process cannot access the file because it is being used by another process
2:45 PM: Warning: Failed to open file "c:\windows\all users\application data\aol\c_america online 9.0a\idb\spool.lst". The process cannot access the file because it is being used by another process
2:45 PM: Warning: Failed to open file "c:\windows\all users\application data\aol\c_america online 9.0a\organize\steventhebol1". The process cannot access the file because it is being used by another process
2:45 PM: Warning: Failed to open file "c:\windows\all users\application data\aol\c_america online 9.0a\organize\cache\steventhebo00". The process cannot access the file because it is being used by another process
2:45 PM: c:\windows\all users\application data\vbouncer (ID = -2147480091)
2:45 PM: sskknwrd.dll (ID = 77733)
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs11114193-5aa4-45da-a60e-70b89a426703.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs730f20cf-cdb3-4d65-8f2d-95ef30636c33.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd1d4414b-8bda-43d9-89bd-9ec41acfc8d8.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse44803c8-5a51-4bfa-8782-94d50f70e7cc.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb9b2a48d-c4cd-4d86-a0cc-4728832b94a1.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8a224e0c-bb1a-4a93-8c7c-28c8b481dac0.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs18c74cf8-7689-443d-a7d5-5d7fc82fb748.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1724a3a0-d343-4b58-8af4-7eb3e0f8f480.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsed1db461-c048-4691-ad24-f7d409bba045.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6e23c905-148a-4306-a532-8d881761b45b.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsad980a3b-dd95-4a55-9a1e-c3102232ef9c.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs06b1dfbf-e9a1-4f76-80ba-2439bb74cd5f.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd675a83f-853f-4194-a057-b19bc4eb0c0c.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdff1fa35-9833-4b7b-9f1b-57abd7991a98.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs64eab38e-f9a2-4f6c-91be-bf199116d41a.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsadde1608-b4f1-424c-969a-1dcd91534295.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse6c43a4c-2674-422b-bc87-11c463c97f10.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs22c072e7-329b-4dad-bfca-83b5538da0de.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1d4c76d4-5b0d-4d9d-a697-41d4ab0ed4ea.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfedb774d-9939-4cbb-a572-ba7dc72f109f.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5e60c3ae-0cbb-4d1b-8ffb-e11ab3024542.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf6122061-54d5-49b3-a2e9-79935aabd6f1.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7b37b338-da9d-498f-abb1-d0f3ffc2a76a.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsbc7b6e75-d3cd-4787-960b-0e208fa96b77.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs47fc6a8d-937d-49c4-9088-b8d15556e1f7.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs07b414fb-6868-497b-90fb-23452143495f.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9f2de995-6124-48fd-b26a-0ee4b67933f8.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2f4ff47e-2ec6-463c-9a8c-c1a940e45574.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7f35d687-2b37-451c-95d2-2e11369e2aec.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd6dfc177-e2b4-4c57-8ef8-054c62988033.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs24011db9-5d8a-4d32-b349-86893fdba134.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd86f5156-b159-41a7-a964-e0c2d343cf04.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2ed4aa6f-99c1-44d0-9252-d258e0d9de92.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2d40a8af-6053-4bca-9c9f-577029c35b2d.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6b21f5c6-c601-409f-9f8f-851cffcd823b.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs113bdf55-64ff-4c1d-823a-583d27733ef3.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs126c5466-d4a9-42d2-9685-aff425b896cc.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs40ff0629-f52c-42e5-81ca-638dbe3897bd.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs74625132-74ce-461c-a3fc-793e43d73cab.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsbfa43361-7df0-4561-8495-d3bb72687a30.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs660c2f42-a669-4a44-af45-46fc197994d3.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4e904197-ce60-44ee-9f52-a39f5aef2fd3.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf18c5f9b-3829-4b84-a30f-253594144aaa.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf920a950-acce-4790-92a7-7da7f416ac3e.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs29b50ca2-019f-4190-9b15-f0efb08dff18.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsadd6bae5-4be2-422f-a330-f444fa4bd984.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3309b54d-d105-4b25-b125-5e8d8baea513.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsec1c621a-e6c6-4cd2-8c27-b922795dcb72.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8e0769bb-6a60-47b0-9c64-a71ef48e3b28.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs851043aa-20cc-46b7-a4e2-c4fb5f0bc639.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs03b162bf-f6f1-41c5-9b3c-4c38d16280ab.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb5c4b7c3-4b98-45f5-a25b-8daf7a27a532.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb4885f02-3477-43ea-bd91-2ee96ea16ef2.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs85687539-ea97-452b-be06-e871355cf22b.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfbc74660-3168-42c9-8091-5602be35e35c.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa9b1e80a-ba5a-46b3-a196-ce92345efbd4.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf0d4292c-14e7-4597-ab88-9d86c95fb9c6.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs12793b99-8d08-43cd-b9e1-9aa347a9a3df.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs89405179-90ed-47c9-aa16-e28c7fa4cf1d.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs502e83c2-aa5f-4be6-b8f3-06144445f8c3.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5fdb169a-0ea2-45ea-96be-6766f6897759.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs839a2fd1-b159-48c8-a5b5-0a54f8963ad9.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa64ab1e2-33ae-4576-b0ca-41e6809c23ef.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6e393cc1-b98a-4edf-8874-a54ade18f7bc.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5d5bad2f-855b-434b-834c-652b77468c40.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs46567374-d3ae-43a8-b496-308e3e401107.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsba2f0c28-9c31-48e6-8fe2-8aa8f409e990.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs515ba8a2-da19-4e22-a82b-0823581e8281.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb398de6d-4c79-482f-9f43-cb0c72257950.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfe2346dc-2299-4304-8bce-289ae88e8d69.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0c285b5a-baa4-4fe8-af03-e646b2ab83d8.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsecd57a3b-ee52-4144-be4b-ee4e425d1db1.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4e6d795f-59ea-46c7-b9d8-1ce6ec05f81b.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs61a5403c-56a5-415b-96e1-fce5df3dd74e.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8a4a2f75-c44c-434f-96b6-cf04292bbfe9.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3991a18b-f453-419d-b266-84c42a15aba5.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse9bbeca2-04f2-47b7-97f4-6030f38111df.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7e67c503-22c6-4a1d-8f6b-471bdb1dd93f.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1395726f-24bf-44f2-9d83-6185fe2e30fe.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs42fd2eef-60df-4f88-8fde-25c1684e1566.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs82b1ebd7-3988-4b69-864a-a4e1e2d9b958.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs2ed19c4c-8237-4c4f-8aee-5cd800bd2033.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1b1af205-720e-4af4-9d09-493ef1115fc0.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs008ed442-a32d-4378-8d3b-c0ab62bb522b.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsdc81784b-7815-451a-8855-7c090d7a008f.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0527ddfe-af5f-43e0-84f5-85486d6d6b96.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd95db490-775f-47b6-9249-e2a0460b8d56.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa71e778f-e381-4314-bc48-d0af300df12d.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb8eb4390-26e6-419e-aad3-a9db690e43b6.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs06dec452-84f2-47f5-93af-8e549cc2b0ab.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7156a704-8757-4276-b81e-d985102a1c01.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa83e7a08-2d81-45f8-b1f9-f0b79b6fa6ba.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa9614090-6175-4666-8590-24d392bbbb5c.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs01e308d6-4a3b-4c61-90f3-2a5ff3ffa7f6.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfefd91dd-bfee-45b7-a17d-9c0f2e57cee2.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6ac4d12a-733c-44da-8b6c-4183b05442dd.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc06392d5-a79f-441f-b564-6c30d638c540.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse546e694-e6d9-4dfc-9f72-ca9a8aea0260.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs48f7da7a-cb7e-4c0c-8998-1f2669d69c75.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs116a612a-3071-4cc6-b3a6-c79cd14bdcb9.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs63dbe8bc-70ee-4019-9d4c-2cc5a8e5ad77.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs244ed40a-ab3e-449f-88eb-4c6ebd12dc08.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs62514a7b-199b-43db-912e-89b4605946da.tmp". The process cannot access the file because it is being used by another process
2:46 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7d9671e4-8eca-472b-99ef-3189bbb8b989.tmp". The process cannot access the file because it is being used by another process
2:47 PM: backup-20050227-113148-501.dll (ID = 50077)
2:48 PM: Found Adware: browseraid
2:48 PM: mcasupd.inf (ID = 51928)
2:48 PM: ysbactivex.dll (ID = 91028)
2:48 PM: ysbactivex.inf (ID = 91033)
2:48 PM: Found Adware: casinopalazzo
2:48 PM: on-line.exe (ID = 52315)
2:49 PM: Found Adware: whenu
2:49 PM: c:\program files\common files\whenu (1 subtraces) (ID = -2147480379)
2:49 PM: wmplayer.exe (ID = 179183)
2:53 PM: Found Adware: bonzi buddy
2:53 PM: bonzi.exe (ID = 51609)
2:53 PM: Found Adware: whenu savenow
2:53 PM: c:\program files\save (ID = -2147480378)
2:54 PM: c:\program files\cxtpls (18 subtraces) (ID = -2147481418)
2:54 PM: wingenerics.dll (ID = 50187)
2:54 PM: ace.dll (ID = 50008)
2:54 PM: cxtpls.dll (ID = 50077)
2:54 PM: cxtpls.exe (ID = 50092)
2:54 PM: proxystub.dll (ID = 50140)
2:54 PM: uninstaller.exe (ID = 50174)
2:54 PM: proxystub.dll (ID = 50140)
2:54 PM: Found Adware: webrebates
2:54 PM: c:\program files\web_rebates (52 subtraces) (ID = -2147480050)
2:54 PM: 00001118.php (ID = 63853)
2:54 PM: 00001126.exe (ID = 90744)
2:54 PM: 00001133.inf (ID = 63846)
2:54 PM: windows media player.lnk (ID = 179183)
2:54 PM: windows media player.lnk (ID = 179183)
2:54 PM: windows media player.lnk (ID = 179183)
2:54 PM: windows media player.lnk (ID = 179183)
2:54 PM: windows media player.lnk (ID = 179183)
2:54 PM: File Sweep Complete, Elapsed Time: 00:12:37
2:54 PM: Full Sweep has completed. Elapsed time 00:21:06
2:54 PM: Traces Found: 326
3:06 PM: Removal process initiated
3:06 PM: Quarantining All Traces: 2nd-thought
3:06 PM: Quarantining All Traces: cws-aboutblank
3:06 PM: Quarantining All Traces: purityscan
3:06 PM: Quarantining All Traces: surfsidekick
3:07 PM: Quarantining All Traces: apropos
3:07 PM: Quarantining All Traces: bonzi buddy
3:07 PM: Quarantining All Traces: marketscore
3:07 PM: Quarantining All Traces: trojan-downloader-pacisoft
3:07 PM: Quarantining All Traces: bookedspace
3:07 PM: Quarantining All Traces: browseraid
3:07 PM: Quarantining All Traces: casinopalazzo
3:07 PM: Quarantining All Traces: command
3:07 PM: Quarantining All Traces: dealhelper
3:07 PM: Quarantining All Traces: ezula ilookup
3:07 PM: Quarantining All Traces: instant access
3:07 PM: Quarantining All Traces: isearch toolbar
3:07 PM: Quarantining All Traces: ist sidefind
3:07 PM: Quarantining All Traces: ist software
3:07 PM: Quarantining All Traces: ist yoursitebar
3:07 PM: Quarantining All Traces: powerscan
3:07 PM: Quarantining All Traces: sexfiles dialers
3:07 PM: Quarantining All Traces: showbehind
3:07 PM: Quarantining All Traces: virtualbouncer
3:08 PM: Quarantining All Traces: webrebates
3:08 PM: Quarantining All Traces: whenu savenow
3:08 PM: Quarantining All Traces: whenu searchbar/pricebandit
3:08 PM: Quarantining All Traces: whenu
3:08 PM: Quarantining All Traces: wurldmedia
3:08 PM: Quarantining All Traces: 2o7.net cookie
3:08 PM: Quarantining All Traces: atwola cookie
3:08 PM: Quarantining All Traces: cc214142 cookie
3:08 PM: Quarantining All Traces: maxserving cookie
3:08 PM: Quarantining All Traces: trafficmp cookie
3:08 PM: Quarantining All Traces: tribalfusion cookie
3:08 PM: Quarantining All Traces: yieldmanager cookie
3:08 PM: Removal process completed. Elapsed time 00:01:29
********
2:14 PM: | Start of Session, Sunday, November 20, 2005 |
2:14 PM: Spy Sweeper started
2:15 PM: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
2:26 PM: Updating spyware definitions
2:32 PM: Your spyware definitions have been updated.
2:33 PM: | End of Session, Sunday, November 20, 2005 |
And here is the hijackthis log...
Logfile of HijackThis v1.99.1
Scan saved at 3:15:08 PM, on 11/20/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\SYSTEM\USBMMKBD.EXE
C:\PROGRAM FILES\ADAPTEC\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\AOL SPYWARE PROTECTION\AOLSP SCHEDULER.EXE
C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLDIAL.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0A\WAOL.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0A\SHELLMON.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\PROGRAM FILES\OPERA\OPERA.EXE
C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWDELAY.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\AOLTPSPD.EXE
C:\WINDOWS\DESKTOP\IMPORTANT FOR SAFE COMP\HIJACKTHIS.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://hp.yahoo.com
F1 - win.ini: run=hpfsched hpfsched
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_2_3_0.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: dlexpertclick Class - {A6927151-F5B4-11D4-AE7A-00D00925CF52} - C:\PROGRA~1\DLEXPERT\DLL\IEHELPER.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_2_3_0.DLL
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Delay] C:\WINDOWS\delayrun.exe
O4 - HKLM\..\Run: [USBMMKBD] usbmmkbd.exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [mgavrtclexe] C:\WINDOWS\MCBin\AV\Rt\mgavrtcl.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [kdx] C:\WINDOWS\KDX\KHOST.EXE
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Detect] C:\Program Files\iNTERNET Turbo\iDetect.exe /auto
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [mgavrtclexe] C:\WINDOWS\MCBin\AV\Rt\mgavrte.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE"
O4 - HKLM\..\RunServices: [Detect] C:\Program Files\iNTERNET Turbo\iDetect.exe /auto
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: &Download by DLExpert (Faster) - C:\Program Files\DLExpert\get.htm
O8 - Extra context menu item: Download &All by DLExpert (Faster) - C:\Program Files\DLExpert\getall.htm
O8 - Extra context menu item: &AOL Toolbar search -
res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O9 - Extra button: DLExpert - {4AB89EA8-E2B8-11d4-AE71-00D00925CF52} - C:\Program Files\DLExpert\DLExpert.exe
O9 - Extra 'Tools' menuitem: &DLExpert - {4AB89EA8-E2B8-11d4-AE71-00D00925CF52} - C:\Program Files\DLExpert\DLExpert.exe
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) -
http://www.gamespot.com/KDX/kdx.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) -
http://www2.incredimail.com/contents/se ... loader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) -
http://ak.imgag.com/imgag/cp/install/AxCtp.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
http://zone.msn.com/binFramework/v10/ZI ... b34246.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) -
http://zone.msn.com/BinFrameWork/v10/ZB ... b32846.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) -
http://zone.msn.com/binframework/v10/St ... b35645.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) -
http://zone.msn.com/binframework/v10/ZP ... b32846.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) -
http://zone.msn.com/binFrameWork/v10/St ... b34120.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -
http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) -
http://www.pcpitstop.com/mhLbl.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net