Yet ANOTHER Blue 'Spyware Infection' Screen lol [CLOSED] |
Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
  |
 Dec 20 2005, 06:50 PM
Post
#1
|
|
|
New Member  Posts: 6 OS: Windows XP  |
Logfile of HijackThis v1.99.1 Scan saved at 00:37:29, on 21/12/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\system32\gearsec.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\LimeWire\LimeWire.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Netscape\Netscape\Netscp.exe C:\Documents and Settings\Marc\Desktop\HighJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.new-access.biz/ R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [antivirus32] ANTIVIRUS.EXE O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [ypcjyww] C:\WINDOWS\ypcjyww.EXE O4 - HKLM\..\Run: [ulvtgsa] C:\WINDOWS\ulvtgsa.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZN O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll O15 - Trusted Zone: www.contentcooler.biz O15 - Trusted Zone: www.new-access.biz O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientIn...2/OCI/setup.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1101222243061 O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FD79ADE3-CA97-4AF8-B9E8-8A7AABE1C08D}: NameServer = 80.225.252.50 80.225.252.58 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\vmaefve.exe (file missing) |
 |
 
|
|
Dec 20 2005, 09:14 PM
Post
#2
|
|
 Malware Expert  Posts: 7,416 From: Omaha, NE, USA OS: Windows Vista Ultimate |
Hello, M2theC.
Download smitRem.exe and save the file to your desktop. Double click on the file to extract it to it's own folder on the desktop. Place a shortcut to Panda ActiveScan on your desktop. Please download the trial version of Ewido Security Suite here: http://www.ewido.net/en/download/ Please read Ewido Setup Instructions Install it, and update the definitions to the newest files. Do NOT run a scan yet. If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates: Ad-Aware SE Setup Don't run it yet! Next, please reboot your computer in SafeMode by doing the following:
=================================================== R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.new-access.biz/ R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll O4 - HKLM\..\Run: [antivirus32] ANTIVIRUS.EXE O4 - HKLM\..\Run: [ypcjyww] C:\WINDOWS\ypcjyww.EXE O4 - HKLM\..\Run: [ulvtgsa] C:\WINDOWS\ulvtgsa.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZN O15 - Trusted Zone: www.contentcooler.biz O15 - Trusted Zone: www.new-access.biz O17 - HKLM\System\CCS\Services\Tcpip\..\{FD79ADE3-CA97-4AF8-B9E8-8A7AABE1C08D}: NameServer = 80.225.252.50 80.225.252.58 O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\vmaefve.exe (file missing) =================================================== Close HiJackThis. Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply. Open Ad-aware and do a full scan. Remove all it finds. Run Ewido:
Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present. Reboot back into Windows. Please download the Killbox by Option^Explicit. Note: In the event you already have Killbox, this is a new version that I need you to download.
If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again. Once in normal mode again click the Panda ActiveScan shortcut. - Once you are on the Panda site click the Scan your PC button - A new window will open...click the Check Now button - Enter your Country - Enter your State/Province - Enter your e-mail address and click send - Select either Home User or Company - Click the big Scan Now button - If it wants to install an ActiveX component allow it - It will start downloading the files it requires for the scan (Note: It may take a couple of minutes) - When download is complete, click on Local Disks to start the scan - When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of smitfiles.txt and the Ewido Log by using Add Reply. Let us know if any problems persist. |
|
|
|
|
Dec 21 2005, 11:14 AM
Post
#3
|
|
|
New Member Posts: 6 OS: Windows XP |
Wow thats alot lol!! al give it a go 2nite and post how i get on.. thanks
|
|
|
|
|
Dec 21 2005, 06:27 PM
Post
#4
|
|
|
New Member Posts: 6 OS: Windows XP |
Got my desktop back!!! Here are some results
Incident Status Location Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\ie0502b.jar-5d2030ae-102eba77.zip[GetAccess.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\ie0502b.jar-5d2030ae-102eba77.zip[NewSecurityClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\ie0502b.jar-5d2030ae-102eba77.zip[NewURLClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\ie0502b.jar-5d2030ae-102eba77.zip[Installer.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\ie0502b.jar-6c5b4ee6-6e2f816d.zip[GetAccess.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\ie0502b.jar-6c5b4ee6-6e2f816d.zip[NewSecurityClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\ie0502b.jar-6c5b4ee6-6e2f816d.zip[NewURLClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\ie0502b.jar-6c5b4ee6-6e2f816d.zip[Installer.class] Adware:Adware/IST.ISTBar Not desinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\javainstaller.jar-4514e5ea-79e349f9.zip[InstallerApplet.class] Adware:Adware/CWS.Searchmeup Not desinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\jrl.jar-2c0df170-5f9b7120.zip[GetAccess.class] Adware:Adware/CWS.Searchmeup Not desinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\jrl.jar-2c0df170-5f9b7120.zip[Installer.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\jrl.jar-2c0df170-5f9b7120.zip[NewSecurityClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\jrl.jar-2c0df170-5f9b7120.zip[NewURLClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-2075dd4b-7b983a15.zip[Beyond.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-2075dd4b-7b983a15.zip[Dummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-2075dd4b-7b983a15.zip[NudeBox.class] Virus:Trj/ClassLoader.P Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-2075dd4b-7b983a15.zip[Worker.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-2075dd4b-7b983a15.zip[VerifierBug.class] Adware:Adware/SpySheriff Not desinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-2075dd4b-7b983a15.zip[javautil.zip] Virus:Trj/Downloader.EAA Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-2075dd4b-7b983a15.zip[bot.exe] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-70bd7dd6-39f50993.zip[Beyond.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-70bd7dd6-39f50993.zip[Dummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-70bd7dd6-39f50993.zip[NudeBox.class] Virus:Trj/ClassLoader.P Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-70bd7dd6-39f50993.zip[Worker.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-70bd7dd6-39f50993.zip[VerifierBug.class] Virus:Trj/Downloader.EAA Disinfected C:\Documents and Settings\Marc\.jpi_cache\jar\1.0\menu.jr-70bd7dd6-39f50993.zip[bot.exe] Spyware:Spyware/SafeSurf Not desinfected C:\Documents and Settings\Marc\Desktop\HighJackThis\backups\backup-20051221-173626-622.dll Adware:Adware/EShopper Not desinfected C:\Documents and Settings\Marc\Desktop\Marcs Tunez\Discreet 3ds max 7 English (full)\Discreet 3ds max 7 English\3ds max 7\Uninstal.exe Adware:Adware/EShopper Not desinfected C:\Documents and Settings\Marc\Desktop\Marcs Tunez\Discreet 3ds max 7 English (full)\Uninstal.exe Dialer:dialer.akd Not desinfected C:\Documents and Settings\Marc\Favorites\explorer.lnk Dialer:dialer.cos Not desinfected C:\Documents and Settings\Marc\Favorites\exsplorer.lnk Adware:Adware/SaveNow Not desinfected C:\Program Files\aaascreensavers\Simpsons Christmas Party Theme\VVSN_AAAS0741Inst.exe Adware:Adware/SAHAgent Not desinfected C:\WINDOWS\9kft2on5.exe Adware:Adware/SAHAgent Not desinfected C:\WINDOWS\system32\2hgscjaf.exe Adware:Adware/SAHAgent Not desinfected C:\WINDOWS\system32\4cr6jgol.exe Adware:Adware/Webext Not desinfected C:\WINDOWS\system32\bho.dll Spyware:Spyware/SafeSurf Not desinfected C:\WINDOWS\system32\InstallerV3.exe Adware:Adware/SAHAgent Not desinfected C:\WINDOWS\system32\uitt514b.dll Logfile of HijackThis v1.99.1 Scan saved at 00:24:49, on 22/12/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\WINDOWS\system32\gearsec.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Netscape\Netscape\Netscp.exe C:\Documents and Settings\Marc\Desktop\HighJackThis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientIn...2/OCI/setup.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1101222243061 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FD79ADE3-CA97-4AF8-B9E8-8A7AABE1C08D}: NameServer = 212.74.114.129 212.74.114.193 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 20:26:59, 21/12/2005 + Report-Checksum: 7FA178A9 + Scan result: HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Ignored HKU\S-1-5-21-73586283-436374069-1801674531-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6CB0-410C-8C3D-8FA8D2011D0A} -> Spyware.iMesh : Ignored HKU\S-1-5-21-73586283-436374069-1801674531-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} -> Spyware.MyWebSearch : Ignored C:\Program Files\aaascreensavers\Simpsons Christmas Party Theme\VVSN_AAAS0741Inst.exe -> Adware.SaveNow : Ignored C:\WINDOWS\9kft2on5.exe -> Adware.SAHA : Ignored C:\WINDOWS\system32\2hgscjaf.exe -> Adware.SAHA : Ignored C:\WINDOWS\system32\4cr6jgol.exe -> Adware.Saha : Ignored C:\WINDOWS\system32\uitt514b.dll -> Adware.SAHA : Ignored HKLM\SOFTWARE\Classes\Interface\{700DC0DD-F409-42E0-9DE5-21EE1A2BA9FD} -> Spyware.TOPicks : Cleaned with backup HKU\S-1-5-21-73586283-436374069-1801674531-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC} -> Spyware.MyWay : Cleaned with backup HKU\S-1-5-21-73586283-436374069-1801674531-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC} -> Spyware.MyWay : Cleaned with backup HKU\S-1-5-21-73586283-436374069-1801674531-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup C:\data -> Downloader.IstBar.nh : Cleaned with backup :mozilla.13:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.14:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.15:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.16:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.17:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.21:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.22:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.23:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.24:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.25:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.26:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.27:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.28:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.29:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.30:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.31:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.32:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.33:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.34:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.35:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.36:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.37:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.38:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.39:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.40:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.41:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.43:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.44:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.45:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.46:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.47:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.48:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.49:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.53:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.54:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.60:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.61:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup :mozilla.62:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.63:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.64:C:\Documents and Settings\Guest\Application Data\Mozilla\Profiles\default\vsvkffb4.slt\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup :mozilla.8:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.10:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.11:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.13:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.15:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.16:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.17:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.35:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.36:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.37:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.38:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.39:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.40:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.41:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.44:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.45:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.46:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.48:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.49:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.50:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.51:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.53:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.56:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.65:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.66:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.67:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.68:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.116:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.117:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.118:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.119:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.120:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup :mozilla.122:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup :mozilla.123:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup :mozilla.131:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.132:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.133:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.137:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.142:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.143:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.144:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.145:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.146:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.147:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.148:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.149:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.150:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.151:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.152:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.153:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.154:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.155:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.156:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.157:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.158:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.159:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.160:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.161:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.162:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.164:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.165:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.166:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.167:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.168:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.169:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.170:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.178:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.179:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.180:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.181:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.186:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.187:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.198:C:\Documents and Settings\Marc\Application Data\Mozilla\Profiles\default\16ufdbmf.slt\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Marc\Cookies\marc@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\WINDOWS\system32\irasglcy.dll -> Spyware.SafeSurfing : Cleaned with backup C:\WINDOWS\system32\netlanm.dll -> Spyware.SafeSurfing : Cleaned with backup C:\WINDOWS\system32\nsbC7.dll -> Spyware.HotSearchBar : Cleaned with backup C:\WINDOWS\system32\nsj11.dll -> Spyware.HotSearchBar : Cleaned with backup C:\WINDOWS\system32\nso65.dll -> Spyware.HotSearchBar : Cleaned with backup C:\WINDOWS\system32\nsr29.dll -> Spyware.HotSearchBar : Cleaned with backup C:\WINDOWS\system32\redtrsha.dll -> Spyware.SafeSurfing : Cleaned with backup C:\WINDOWS\system32\richup.exe -> Spyware.SafeSurfing : Cleaned with backup ::Report End smitRem © log file version 2.8 by noahdfear Microsoft Windows XP [Version 5.1.2600] The current date is: 21/12/2005 The current time is: 19:33:07.42 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ checking for ShudderLTD key ShudderLTD key not present! checking for PSGuard.com key PSGuard.com key not present! spyaxe uninstaller NOT present ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Existing Pre-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 1944 'explorer.exe' Error 0x5 : Access is denied. Starting registry repairs Deleting files Remaining Post-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~ Wininet.dll ~~~ CLEAN!  |
|
|
|
|
Dec 21 2005, 11:20 PM
Post
#5
|
|
|
Malware Expert Posts: 7,416 From: Omaha, NE, USA OS: Windows Vista Ultimate |
Hello M2theC,
If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again. How is your computer running now? |
|
|
|