[kelltech]

My desktop was replaced by a huge "warning infected cpmputer" image and an html keeps appearing on my desktop called "adware reviews" and the properties point to http://www.topadware.../?adv=196&ads=b which I HAVE NOT clicked. Also, in the system tray I keep getting these 2 popup balloon alerts saying "critical system alert:spyware detected"

I have run a virus scan (ca ez ntivirus), and etrust pest patrol, plus ad-aware, spybot and the smitrem tool from http://noahdfear.geekstogo.com/. After the smitrem tool it looked fixed for about 2 minutes. I dont know what else to do, so here is my hijackthis log. I sure appreciate any help!

Logfile of HijackThis v1.99.1
Scan saved at 2:06:46 AM, on 3/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5296.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust Anti-Spam\QSP-4.0.380.0\QOELoader.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
C:\Program Files\Ahead\Nero BackItUp\NBJ.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wupdmgr.exe
C:\WINDOWS\osaupd.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Irish\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=54729
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....cid={SUB_CLCID}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: winapi32.MyBHO - {86A0607D-6126-45AE-8A29-46C181AFF4D6} - C:\WINDOWS\system32\winapi32.dll (file missing)
O2 - BHO: (no name) - {8702d9e1-890b-4bf2-a233-fa44e582b2de} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {9EAC0102-5E61-2312-BC2D-000000000000} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-716d74632608} - (no file)
O2 - BHO: (no name) - {d53b810f-6219-11d4-95b6-0040950375e7} - (no file)
O2 - BHO: (no name) - {dd6f50c0-9f8f-a41c-291e-7b3fb818ef18} - (no file)
O2 - BHO: (no name) - {f21bd77e-0cce-c6cd-4f85-aa3b7895988e} - (no file)
O2 - BHO: (no name) - {ff731508-cd28-e0b0-3e85-0cf55fde9fba} - (no file)
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust Anti-Spam\QSP-4.0.380.0\QOELoader.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [cme] C:\WINDOWS\system32\cme.exe
O4 - HKLM\..\Run: [cmeupd] C:\WINDOWS\system32\cmeupd.exe
O4 - HKLM\..\Run: [gmt] C:\WINDOWS\system32\gmt.exe
O4 - HKLM\..\Run: [Dynamic Desktop Media] C:\WINDOWS\system32\sysu.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: WKCALREM.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {46C66BBD-E667-4DAD-9682-58050E7C9FDC} (CDPass Class) - http://www.cdpass.com/cdkey/CDPass.cab
O16 - DPF: {63DF43C2-469A-41F3-B119-17B1ACE8BB34} (Sony SNC-RZ30 Image Viewer) - http://207.67.84.159...SncRz30View.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1117055026139
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://209.67.146.68.../ACNePlayer.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.c...driveragent.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Advertisements]

Hi kelltech, and welcome to Geeks to Go.

I'm currently analyzing your log, and will post instructions to start with the clean up soon .

[Antartic-Boy]

Hi kelltech, and welcome to Geeks to Go.

I'm currently analyzing your log, and will post instructions to start with the clean up soon .

[Antartic-Boy]

-----------------------1

Download smitRem.exe ©noahdfear, and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop (in Internet Explorer, right click on Panda ActiveScan link select "Copy Shortcut" then right click on your desktop and select "Paste Shortcut" or in FireFox right-click the link and select "Save Link As" and save it to your desktop).

Please download the trial version of ewido anti-malware here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Don't run it yet!

-----------------------2

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Now scan with HJT and place a checkmark next to each of the following items and click FIX CHECKED:

O2 - BHO: winapi32.MyBHO - {86A0607D-6126-45AE-8A29-46C181AFF4D6} - C:\WINDOWS\system32\winapi32.dll (file missing)
O2 - BHO: (no name) - {8702d9e1-890b-4bf2-a233-fa44e582b2de} - (no file)
O2 - BHO: (no name) - {9EAC0102-5E61-2312-BC2D-000000000000} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-716d74632608} - (no file)
O2 - BHO: (no name) - {d53b810f-6219-11d4-95b6-0040950375e7} - (no file)
O2 - BHO: (no name) - {dd6f50c0-9f8f-a41c-291e-7b3fb818ef18} - (no file)
O2 - BHO: (no name) - {f21bd77e-0cce-c6cd-4f85-aa3b7895988e} - (no file)
O2 - BHO: (no name) - {ff731508-cd28-e0b0-3e85-0cf55fde9fba} - (no file)
O4 - HKLM\..\Run: [cme] C:\WINDOWS\system32\cme.exe
O4 - HKLM\..\Run: [cmeupd] C:\WINDOWS\system32\cmeupd.exe
O4 - HKLM\..\Run: [gmt] C:\WINDOWS\system32\gmt.exe
O4 - HKLM\..\Run: [Dynamic Desktop Media] C:\WINDOWS\system32\sysu.exe
O16 - DPF: {46C66BBD-E667-4DAD-9682-58050E7C9FDC} (CDPass Class) - http://www.cdpass.com/cdkey/CDPass.cab
O16 - DPF: {63DF43C2-469A-41F3-B119-17B1ACE8BB34} (Sony SNC-RZ30 Image Viewer) - http://207.67.84.159...SncRz30View.cab
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://209.67.146.68.../ACNePlayer.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.c...driveragent.cab

Close HiJackThis.

-----------------------3

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

-----------------------4

Open Ad-aware and do a full scan. Remove all it finds.

-----------------------5

Run Ewido:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• While the scan is in progress you will be prompted to clean files, click OK
• When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop.

Close ewido anti-malware.

-----------------------6

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

-----------------------7

Now please unhide hidden files and folders:

1.Click Start.
2.Open My Computer.
3.Select the Tools menu and click Folder Options.
4.Select the View Tab.
5.Under the Hidden files and folders heading select Show hidden files and folders.
6.Uncheck the Hide protected operating system files (recommended) option.
7.Click Yes to confirm.
8.Click OK.

Now please delete these files using Microsoft explorer (if present):
To run Microsoft explorer please go to Start -> Run -> type in explorer -> click on OK button

C:\WINDOWS\wupdmgr.exe
C:\WINDOWS\system32\cme.exe
C:\WINDOWS\system32\cmeupd.exe
C:\WINDOWS\system32\gmt.exe
C:\WINDOWS\system32\sysu.exe
C:\WINDOWS\osaupd.exe

Now hide hidden files and folders:

1.Click Start.
2.Open My Computer.
3.Select the Tools menu and click Folder Options.
4.Select the View Tab.
5.Under the Hidden files and folders heading select Show hidden files and folders.
6.Check the Hide protected operating system files (recommended) option.
7.Click Yes to confirm.
8.Click OK.

-----------------------8

Reboot back into Windows and click the Panda ActiveScan shortcut.

• Once you are on the Panda site click the Scan your PC button.
• A new window will open...click the Check Now button.
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When the download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of smitfiles.txt and the Ewido Log by using Add Reply.
Let us know if any problems persist.

Edited by Antartic-Boy, 05 March 2006 - 06:32 AM.

[kelltech]

Thank you for your help Antartic Boy. Although I saw some 13 or so 'spyware' in that final Panda scan, we appear to be running clean. I did notice also when I was in safe mode on step# 7 deleting files in the Windows directory there is a gator.exe; C:\Windows\System32\gator.exe but I left it alone for now. I never installed gator or use it. Here are the reports, and I also included that second Panda scan report:

HJ:
Logfile of HijackThis v1.99.1
Scan saved at 9:55:17 PM, on 3/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5296.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Irish\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=54729
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....cid={SUB_CLCID}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: winapi32.MyBHO - {86A0607D-6126-45AE-8A29-46C181AFF4D6} - C:\WINDOWS\system32\winapi32.dll (file missing)
O2 - BHO: (no name) - {8702d9e1-890b-4bf2-a233-fa44e582b2de} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {9EAC0102-5E61-2312-BC2D-000000000000} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {d53b810f-6219-11d4-95b6-0040950375e7} - (no file)
O2 - BHO: (no name) - {dd6f50c0-9f8f-a41c-291e-7b3fb818ef18} - (no file)
O2 - BHO: (no name) - {f21bd77e-0cce-c6cd-4f85-aa3b7895988e} - (no file)
O2 - BHO: (no name) - {ff731508-cd28-e0b0-3e85-0cf55fde9fba} - (no file)
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust Anti-Spam\QSP-4.0.380.0\QOELoader.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [cme] C:\WINDOWS\system32\cme.exe
O4 - HKLM\..\Run: [cmeupd] C:\WINDOWS\system32\cmeupd.exe
O4 - HKLM\..\Run: [gmt] C:\WINDOWS\system32\gmt.exe
O4 - HKLM\..\Run: [Dynamic Desktop Media] C:\WINDOWS\system32\sysu.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: WKCALREM.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: wupdmgr.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {46C66BBD-E667-4DAD-9682-58050E7C9FDC} (CDPass Class) - http://www.cdpass.com/cdkey/CDPass.cab
O16 - DPF: {63DF43C2-469A-41F3-B119-17B1ACE8BB34} (Sony SNC-RZ30 Image Viewer) - http://207.67.84.159...SncRz30View.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1117055026139
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://209.67.146.68.../ACNePlayer.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.c...driveragent.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Smitfiles:

smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
The current date is: Sun 03/05/2006
The current time is: 22:06:28.25

Running from
C:\Documents and Settings\Irish\Desktop\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{553858A7-4922-4e7e-B1C1-97140C1C16EF}"="IE Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{553858A7-4922-4e7e-B1C1-97140C1C16EF}\InProcServer32]
@="%SystemRoot%\system32\ieframe.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 952 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{553858A7-4922-4e7e-B1C1-97140C1C16EF}"="IE Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{553858A7-4922-4e7e-B1C1-97140C1C16EF}\InProcServer32]
@="%SystemRoot%\system32\ieframe.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN!

Ewido Log:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 12:34:58 AM, 3/6/2006
+ Report-Checksum: 38C53E06

+ Scan result:

HKU\S-1-5-21-2000478354-2111687655-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DA7FF3F8-08BE-4CAC-BC00-94D91C6AE7F4} -> Adware.MWSearch : Cleaned with backup
HKU\S-1-5-21-2000478354-2111687655-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DD6F50C0-9F8F-A41C-291E-7B3FB818EF18} -> Adware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-2000478354-2111687655-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F21BD77E-0CCE-C6CD-4F85-AA3B7895988E} -> Adware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-2000478354-2111687655-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F65B197F-8260-4D52-909A-F70118E646EB} -> Adware.MWSearch : Cleaned with backup
HKU\S-1-5-21-2000478354-2111687655-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FF731508-CD28-E0B0-3E85-0CF55FDE9FBA} -> Adware.CoolWebSearch : Cleaned with backup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\wupdmgr.exe -> Downloader.Small.ckc : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Blondey\Application Data\Mozilla\Firefox\Profiles\e8o0xiaw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Blondey\Application Data\Mozilla\Firefox\Profiles\e8o0xiaw.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Blondey\Application Data\Mozilla\Firefox\Profiles\e8o0xiaw.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Blondey\Application Data\Mozilla\Firefox\Profiles\e8o0xiaw.default\cookies.txt -> TrackingCookie.Tracking101 : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Blondey\Application Data\Mozilla\Firefox\Profiles\e8o0xiaw.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Blondey\Application Data\Mozilla\Firefox\Profiles\e8o0xiaw.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Blondey\Application Data\Mozilla\Firefox\Profiles\e8o0xiaw.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Blondey\Application Data\Mozilla\Firefox\Profiles\e8o0xiaw.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Bfast : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Blondiee\Application Data\Mozilla\Firefox\Profiles\wf749srl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][1].txt -> TrackingCookie.Euroclick : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][1].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\blondiee@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Blondiee\Cookies\[email protected][2].txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.12:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.87:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.97:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.104:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.160:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.161:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.162:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.163:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.168:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.172:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.209:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.210:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.211:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.212:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.213:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.214:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.215:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.216:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.217:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.227:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.228:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.229:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.230:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.231:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.232:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.233:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.284:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Hypertracker : Cleaned with backup
:mozilla.344:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.369:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.410:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.411:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.429:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.436:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup
:mozilla.437:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup
:mozilla.438:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup
:mozilla.439:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.440:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.441:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.442:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.458:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.459:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.477:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.478:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.479:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.480:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.499:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.505:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.506:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.507:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.546:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.547:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.548:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.549:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.550:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.551:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.552:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.553:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.555:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.581:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.594:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.595:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.596:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.597:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.598:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.599:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.600:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.601:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.602:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.603:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.604:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.605:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.606:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.607:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.609:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.610:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.655:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.656:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.657:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.658:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.683:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.684:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.694:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.695:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.696:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.715:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Realtracker : Cleaned with backup
:mozilla.716:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Realtracker : Cleaned with backup
:mozilla.766:C:\Documents and Settings\Irish\Application Data\Mozilla\Firefox\Profiles\whj4k4vl.default\cookies.txt -> TrackingCookie.Directnetadvertising : Cleaned with backup
:mozilla.767:C:\Documents and Settings�

[Antartic-Boy]

-----------------------1

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O2 - BHO: winapi32.MyBHO - {86A0607D-6126-45AE-8A29-46C181AFF4D6} - C:\WINDOWS\system32\winapi32.dll (file missing)
O2 - BHO: (no name) - {8702d9e1-890b-4bf2-a233-fa44e582b2de} - (no file)
O2 - BHO: (no name) - {9EAC0102-5E61-2312-BC2D-000000000000} - (no file)
O2 - BHO: (no name) - {d53b810f-6219-11d4-95b6-0040950375e7} - (no file)
O2 - BHO: (no name) - {dd6f50c0-9f8f-a41c-291e-7b3fb818ef18} - (no file)
O2 - BHO: (no name) - {f21bd77e-0cce-c6cd-4f85-aa3b7895988e} - (no file)
O2 - BHO: (no name) - {ff731508-cd28-e0b0-3e85-0cf55fde9fba} - (no file)
O4 - HKLM\..\Run: [cme] C:\WINDOWS\system32\cme.exe
O4 - HKLM\..\Run: [cmeupd] C:\WINDOWS\system32\cmeupd.exe
O4 - HKLM\..\Run: [gmt] C:\WINDOWS\system32\gmt.exe
O4 - HKLM\..\Run: [Dynamic Desktop Media] C:\WINDOWS\system32\sysu.exe
O4 - Global Startup: wupdmgr.exe
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://209.67.146.68.../ACNePlayer.cab

Now close all windows and browsers other than HiJackThis, then click Fix Checked.
Close HijackThis.

-----------------------2

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.

• Save it to your desktop.
• Please double-click Killbox.exe to run it.
• Select:
  • Delete on Reboot
  • then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  

  C:\WINDOWS\system32\cme.exe
  C:\WINDOWS\system32\cmeupd.exe
  C:\WINDOWS\system32\gmt.exe
  C:\WINDOWS\system32\sysu.exe

  
  
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

-----------------------3

Please post me a fresh Hjt Log..

[kelltech]

I ran the HJ and those entries you said to delete aren't there. I also went to the system32 folder and those .exe's aren't there either. Here is the most recent HJ report I was looking for these entries on:

Logfile of HijackThis v1.99.1
Scan saved at 6:52:26 PM, on 3/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5296.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust Anti-Spam\QSP-4.0.380.0\QOELoader.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
C:\Program Files\Ahead\Nero BackItUp\NBJ.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Irish\Desktop\hijackthis\HijackThis.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\autodown.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=54729
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....cid={SUB_CLCID}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust Anti-Spam\QSP-4.0.380.0\QOELoader.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: WKCALREM.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1117055026139
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Antartic-Boy]

-----------------------1

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

-----------------------2

Please post me the Kaspersky report and tell me how is the computer running now..

[kelltech]

Overall, the computer is running good, I haven't had any of those system tray baloons or the annoying desktop thing again. I did however find something very strange. I opened my Office Outlook and in the prompt to choose a profile there is listed a bunch of new weird profiles beginning with PSTLOADTMP000 and it lists 35 different profiles in that prompt through PSTLOADTMP035.
I went into C:\Documents and Settings\Irish\Application Data\Microsoft\Outlook and those are not to be found in there. Very strange.

Here is that Kaspersky report with some interesting finds:
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Tuesday, March 07, 2006 6:33:13 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 7/03/2006
Kaspersky Anti-Virus database records: 180655
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\

Scan Statistics:
Total number of scanned objects: 155685
Number of viruses found: 2
Number of infected objects: 13
Number of suspicious objects: 0
Duration of the scan process: 01:13:15

Infected Object Name / Virus Name / Last Action
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109407.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109414.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109427.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109445.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109453.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109465.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109510.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109529.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP384\A0109551.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP385\A0109594.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP385\A0109595.exe Infected: Trojan-Downloader.Win32.Adload.w skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP385\A0109596.exe Infected: not-virus:Hoax.Win32.Renos.bk skipped
C:\System Volume Information\_restore{8E8B01E9-4CF8-47DF-B547-FCC3B2748C3C}\RP385\snapshot\MFEX-1.DAT Infected: not-virus:Hoax.Win32.Renos.bk skipped

Scan process completed.

Edited by kelltech, 07 March 2006 - 08:50 PM.

[Antartic-Boy]

-----------------------1

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Restart your computer.

3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.
[/list]System Restore will now be active again.

----------------------->

Great job it appears your logfile is clean.

The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

• Spybot Search & Destroy - Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.
  
• AdAware - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.
• SpywareBlaster - Great prevention tool to keep nasties from installing on your system.
  
• SpywareGuard - Works as a Spyware "Shield" to protect your computer from getting malware in the first place.
  
• IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
• CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
• Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
• Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.
• Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

[kelltech]

SWEET!
Thank you for your time & your help! I have just one more question, what do you think of those 35 new profiles in my outlook with the PSTLOADTMP000 names, do you think they are harmless? Thank you again for your great help and easy instructions!

[Antartic-Boy]

Please post that question in this forum -> here..

Edited by Antartic-Boy, 08 March 2006 - 10:36 AM.

[Antartic-Boy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.