malewarepipe; virus blast; spyheal; virus rescue [RESOLVED]
Started by
garyjlee
, Sep 05 2006 10:54 AM
#1
Posted 05 September 2006 - 10:54 AM
#2
Posted 05 September 2006 - 11:39 AM
Please Click here!, and follow the recommendations in the guide.
If you're still having trouble, We'll need you to use a free diagnostic tool, Hijack This. Follow the instructions in step five of this guide, and reply here with your log.
Most of what Hijack This lists lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.
If you're still having trouble, We'll need you to use a free diagnostic tool, Hijack This. Follow the instructions in step five of this guide, and reply here with your log.
Most of what Hijack This lists lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.
#3
Posted 05 September 2006 - 12:28 PM
Gosh, I'm feeling a little stupid here...hope this is getting back to Mr. Crusty!
Thanks!!!
Logfile of HijackThis v1.99.1
Scan saved at 11:12:16 AM, on 9/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\HPConfig.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Media-Codec\pmsngr.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\ISP.COM High Speed\slipcore.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISP.COM High Speed\slipgui.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Gary Lee\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presari...t...c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5404
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\Media-Codec\isaddon.dll (file missing)
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ISP.COM High Speed\PBHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ISP.COM High Speed - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ISP.COM High Speed\Toolband.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\ISP.COM High Speed\slipcore.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ISP.COM High Speed.lnk = C:\Program Files\ISP.COM High Speed\slipgui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/327
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/328
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Advisor - {460692F5-B18A-4EBB-AE05-1B321C876AA2} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {272D793A-7AE3-5867-D25D-354B634AFCDC} - http://85.255.113.214/1/gdnUS2218.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akama...meInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E26BB9F-3DB2-454F-898D-76CFE0BCA589}: NameServer = 63.93.96.20 63.93.96.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E26BB9F-3DB2-454F-898D-76CFE0BCA589}: NameServer = 63.93.96.20 63.93.96.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
Thanks!!!
Logfile of HijackThis v1.99.1
Scan saved at 11:12:16 AM, on 9/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\HPConfig.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Media-Codec\pmsngr.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\ISP.COM High Speed\slipcore.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISP.COM High Speed\slipgui.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Gary Lee\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presari...t...c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5404
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\Media-Codec\isaddon.dll (file missing)
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ISP.COM High Speed\PBHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ISP.COM High Speed - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ISP.COM High Speed\Toolband.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\ISP.COM High Speed\slipcore.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ISP.COM High Speed.lnk = C:\Program Files\ISP.COM High Speed\slipgui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/327
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/328
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Advisor - {460692F5-B18A-4EBB-AE05-1B321C876AA2} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {272D793A-7AE3-5867-D25D-354B634AFCDC} - http://85.255.113.214/1/gdnUS2218.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akama...meInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E26BB9F-3DB2-454F-898D-76CFE0BCA589}: NameServer = 63.93.96.20 63.93.96.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E26BB9F-3DB2-454F-898D-76CFE0BCA589}: NameServer = 63.93.96.20 63.93.96.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
#4
Posted 05 September 2006 - 01:07 PM
Hello Gary and welcome to Geeks to Go
As an introduction, please note that I am not Superhuman, I do not know everything, but what I do know has taken me years to learn. I am happy to pass on this information to you, but please bear in mind that I am also fallible.
Please note that you should have Administrator rights to perform the fixes. Also note that multiple identity PC’s (family PC’s) present a different problem; please tell me if your PC has more than one individual’s setting, but continue with the fix.
Before we get underway, you may wish to print these instructions for easy reference during the fix, although please be aware that many of the required URLs are hyperlinks in the red names shown on your screen. Part of the fix may require you to be in Safe Mode, which will not allow you to access the internet, or my instructions! (Click the Options drop down near the upper right of the topic. Select Print this topic.)
You have a mixture of malware and a Puper infection. Let’s see what we can do.
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.
A. Please download the 30-day trial version of: Ewido Anti-Spyware
Safe Mode
C. Open the SmitfraudFix Folder, (right click and choose Extract All) then double-click smitfraudfix.cmd file to start the tool. Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.
A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.
The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________
D. Clean out your Temporary Internet files. Proceed like this:
Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________
E. Close ALL open Windows / Programmes / Folders.
______________________________
F. Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the Programme and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
______________________________
G. Please post:
As an introduction, please note that I am not Superhuman, I do not know everything, but what I do know has taken me years to learn. I am happy to pass on this information to you, but please bear in mind that I am also fallible.
Please note that you should have Administrator rights to perform the fixes. Also note that multiple identity PC’s (family PC’s) present a different problem; please tell me if your PC has more than one individual’s setting, but continue with the fix.
Before we get underway, you may wish to print these instructions for easy reference during the fix, although please be aware that many of the required URLs are hyperlinks in the red names shown on your screen. Part of the fix may require you to be in Safe Mode, which will not allow you to access the internet, or my instructions! (Click the Options drop down near the upper right of the topic. Select Print this topic.)
You have a mixture of malware and a Puper infection. Let’s see what we can do.
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.
A. Please download the 30-day trial version of: Ewido Anti-Spyware
- Please install, and update Ewido Anti-Spyware
- Load Ewido and then click the Update tab at the top. Under Manual Update click Start update.
- After the update finishes (the status bar at the bottom will display "Update successful")
- Please select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
- Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
- Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"
- Close Ewido. Do not run it yet.
- Restart your computer
- After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
- Instead of Windows loading as normal, a menu should appear
- Select the first option, to run Windows in Safe Mode.
Safe Mode
C. Open the SmitfraudFix Folder, (right click and choose Extract All) then double-click smitfraudfix.cmd file to start the tool. Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.
A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.
The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________
D. Clean out your Temporary Internet files. Proceed like this:
- Quit Internet Explorer and quit any instances of Windows Explorer.
- Click Start, click Control Panel, and then double-click Internet Options.
- On the General tab, click Delete Files under Temporary Internet Files.
- In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
- On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
- Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
- Click OK.
Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________
E. Close ALL open Windows / Programmes / Folders.
- In Safe Mode, load Ewido and click on the Scanner tab at the top and then click on Complete System Scan. This scan can take quite a while to run, so be patient.
- Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side.
- Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (I suggest the Desktop).
______________________________
F. Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the Programme and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
______________________________
G. Please post:
- c:\rapport.txt
- Ewido log
- A new HijackThis log (from normal mode).
#5
Posted 05 September 2006 - 03:23 PM
I could not load Ewido (due to Acive X not enabled on my browser, which menas nothing to me!), but was able to load a miscroscanner version, which produced a lengthy list of infected files (attached).
I have also attached the rapport file and a new HTL. Please let me know what to do next. Thanks again!!!
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@2o7[2].txt
Risk: Medium
Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@atdmt[1].txt
Risk: Medium
Name: TrackingCookie.Clickbank
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@clickbank[1].txt
Risk: Medium
Name: TrackingCookie.Com
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@com[1].txt
Risk: Medium
Name: TrackingCookie.Cpvfeed
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@cpvfeed[2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\cookies\gary [email protected][1].txt
Risk: Medium
Name: Adware.Generic
Path: HKLM\SOFTWARE\Classes\CLSID\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}
Risk: Medium
Name: Adware.Generic
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}
Risk: Medium
Name: Adware.IntCodec
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006
Risk: Medium
Name: Adware.IntCodec
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On
Risk: Medium
Name: Adware.IntCodec
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03
Risk: Medium
Name: Adware.IntCodec
Path: HKU\S-1-5-21-3965084991-1869711111-367205786-1006\Software\Internet Security
Risk: Medium
Name: Adware.Generic
Path: HKU\S-1-5-21-3965084991-1869711111-367205786-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1DA7DBE8-C51B-4AE4-BC6E-21863349B0B4}
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.247realmedia
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@247realmedia[1].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@2o7[1].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@2o7[3].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Specificclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Addynamix
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Specificpop
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.X10
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@advertising[2].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@atdmt[2].txt
Risk: Medium
Name: TrackingCookie.Bfast
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@bfast[2].txt
Risk: Medium
Name: TrackingCookie.Bluestreak
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@bluestreak[2].txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Burstnet
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@burstnet[2].txt
Risk: Medium
Name: TrackingCookie.Porngraph
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Casalemedia
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@casalemedia[2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Centrport
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@centrport[1].txt
Risk: Medium
Name: TrackingCookie.Com
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@com[2].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitslink
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sexcounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Coremetrics
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@doubleclick[1].txt
Risk: Medium
Name: TrackingCookie.Ru4
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Euniverseads
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@euniverseads[1].txt
Risk: Medium
Name: TrackingCookie.Fastclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@fastclick[1].txt
Risk: Medium
Name: TrackingCookie.Wegcash
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@hitbox[2].txt
Risk: Medium
Name: TrackingCookie.Masterstats
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Ivwbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@ivwbox[2].txt
Risk: Medium
Name: TrackingCookie.Linksynergy
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@linksynergy[1].txt
Risk: Medium
Name: TrackingCookie.Mediaplex
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@mediaplex[2].txt
Risk: Medium
Name: TrackingCookie.Overture
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@overture[1].txt
Risk: Medium
Name: TrackingCookie.Paycounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@paycounter[2].txt
Risk: Medium
Name: TrackingCookie.Overture
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Wegcash
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Qksrv
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@qksrv[1].txt
Risk: Medium
Name: TrackingCookie.Questionmarket
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@questionmarket[1].txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@serving-sys[1].txt
Risk: Medium
Name: TrackingCookie.Sexcounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@sexcounter[1].txt
Risk: Medium
Name: TrackingCookie.Sexlist
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@sexlist[2].txt
Risk: Medium
Name: TrackingCookie.Starware
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@starware[2].txt
Risk: Medium
Name: TrackingCookie.Onestat
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Statcounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@statcounter[1].txt
Risk: Medium
Name: TrackingCookie.Webtrendslive
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Coremetrics
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Trafficmp
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@trafficmp[1].txt
Risk: Medium
Name: TrackingCookie.Tribalfusion
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@tribalfusion[2].txt
Risk: Medium
Name: TrackingCookie.Valueclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@valueclick[1].txt
Risk: Medium
Name: TrackingCookie.Valueclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@valueclick[3].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Web-stat
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@webstat[1].txt
Risk: Medium
Name: TrackingCookie.Burstbeacon
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Myaffiliateprogram
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Web-stat
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Xxxcounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@xxxcounter[2].txt
Risk: Medium
Name: TrackingCookie.Esomniture
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@y-1shz2prbmdj6wvny-1sez2pra2dj6wjliclczakpa6dj6x9ny-1seq-2-2.stats.esomniture[2].txt
Risk: Medium
Name: TrackingCookie.Yadro
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@yadro[1].txt
Risk: Medium
Name: TrackingCookie.Adserver
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Zedo
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@zedo[2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.26:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.27:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.28:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.29:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.30:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.31:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.32:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.33:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.34:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.35:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: :mozilla.36:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: :mozilla.37:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: :mozilla.38:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: :mozilla.39:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Burstnet
Path: :mozilla.63:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Com
Path: :mozilla.67:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Com
Path: :mozilla.68:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Sexcounter
Path: :mozilla.70:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Sexcounter
Path: :mozilla.71:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: :mozilla.77:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: :mozilla.78:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Ru4
Path: :mozilla.86:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Ru4
Path: :mozilla.87:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Ru4
Path: :mozilla.88:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.138:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Overture
Path: :mozilla.152:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Overture
Path: :mozilla.153:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Overture
Path: :mozilla.163:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Qksrv
Path: :mozilla.165:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Qksrv
Path: :mozilla.166:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.184:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: :mozilla.185:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: :mozilla.186:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: :mozilla.187:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: :mozilla.188:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Statcounter
Path: :mozilla.189:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Statcounter
Path: :mozilla.190:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Statcounter
Path: :mozilla.191:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Tribalfusion
Path: :mozilla.194:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Adserver
Path: :mozilla.204:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Adserver
Path: :mozilla.205:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: :mozilla.214:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: :mozilla.215:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: :mozilla.216:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@2o7[2].txt
Risk: Medium
Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@atdmt[1].txt
Risk: Medium
Name: TrackingCookie.Clickbank
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@clickbank[1].txt
Risk: Medium
Name: TrackingCookie.Com
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@com[1].txt
Risk: Medium
Name: TrackingCookie.Cpvfeed
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@cpvfeed[2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Local Settings\Temp\Cookies\gary [email protected][1].txt
Risk: Medium
Name: Not-A-Virus.Hoax.Win32.Renos.ec
Path: C:\Documents and Settings\Gary Lee\Local Settings\Temp\tmp76.tmp
Risk: Low
Name: Adware.SpywareQuake
Path: C:\Documents and Settings\Gary Lee\Start Menu\Programs\SpyQuake2.com
Risk: Medium
Name: Trojan.Small
Path: C:\Program Files\Media-Codec
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\iesuninst.exe
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\isauninst.exe
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\ot.ico
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\pmsngr.exe
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\pmuninst.exe
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\ts.ico
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\uninst.exe
Risk: High
SmitFraudFix v2.83
Scan done at 13:53:56.58, Tue 09/05/2006
Run from C:\Documents and Settings\Gary Lee\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\DOCUME~1\GARYLE~1\STARTM~1\Programs\SpyQuake2.com Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
C:\Program Files\Media-Codec\ Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
Logfile of HijackThis v1.99.1
Scan saved at 2:14:58 PM, on 9/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\HPConfig.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\Agent\mcupdui.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\ISP.COM High Speed\slipcore.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISP.COM High Speed\slipgui.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\vso\mcmnhdlr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Gary Lee\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presari...t...c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presari...t...c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5404
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ISP.COM High Speed\PBHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ISP.COM High Speed - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ISP.COM High Speed\Toolband.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\ISP.COM High Speed\slipcore.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ISP.COM High Speed.lnk = C:\Program Files\ISP.COM High Speed\slipgui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/327
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/328
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Advisor - {460692F5-B18A-4EBB-AE05-1B321C876AA2} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {272D793A-7AE3-5867-D25D-354B634AFCDC} - http://85.255.113.214/1/gdnUS2218.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akama...meInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E26BB9F-3DB2-454F-898D-76CFE0BCA589}: NameServer = 63.93.96.20 63.93.96.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E26BB9F-3DB2-454F-898D-76CFE0BCA589}: NameServer = 63.93.96.20 63.93.96.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
I have also attached the rapport file and a new HTL. Please let me know what to do next. Thanks again!!!
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@2o7[2].txt
Risk: Medium
Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@atdmt[1].txt
Risk: Medium
Name: TrackingCookie.Clickbank
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@clickbank[1].txt
Risk: Medium
Name: TrackingCookie.Com
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@com[1].txt
Risk: Medium
Name: TrackingCookie.Cpvfeed
Path: C:\Documents and Settings\Gary Lee\cookies\gary lee@cpvfeed[2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\cookies\gary [email protected][1].txt
Risk: Medium
Name: Adware.Generic
Path: HKLM\SOFTWARE\Classes\CLSID\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}
Risk: Medium
Name: Adware.Generic
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}
Risk: Medium
Name: Adware.IntCodec
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006
Risk: Medium
Name: Adware.IntCodec
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On
Risk: Medium
Name: Adware.IntCodec
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03
Risk: Medium
Name: Adware.IntCodec
Path: HKU\S-1-5-21-3965084991-1869711111-367205786-1006\Software\Internet Security
Risk: Medium
Name: Adware.Generic
Path: HKU\S-1-5-21-3965084991-1869711111-367205786-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1DA7DBE8-C51B-4AE4-BC6E-21863349B0B4}
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.247realmedia
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@247realmedia[1].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@2o7[1].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@2o7[3].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Specificclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Addynamix
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Specificpop
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.X10
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@advertising[2].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@atdmt[2].txt
Risk: Medium
Name: TrackingCookie.Bfast
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@bfast[2].txt
Risk: Medium
Name: TrackingCookie.Bluestreak
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@bluestreak[2].txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Burstnet
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@burstnet[2].txt
Risk: Medium
Name: TrackingCookie.Porngraph
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Casalemedia
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@casalemedia[2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Centrport
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@centrport[1].txt
Risk: Medium
Name: TrackingCookie.Com
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@com[2].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitslink
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sextracker
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Sexcounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Coremetrics
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@doubleclick[1].txt
Risk: Medium
Name: TrackingCookie.Ru4
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Euniverseads
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@euniverseads[1].txt
Risk: Medium
Name: TrackingCookie.Fastclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@fastclick[1].txt
Risk: Medium
Name: TrackingCookie.Wegcash
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@hitbox[2].txt
Risk: Medium
Name: TrackingCookie.Masterstats
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Ivwbox
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@ivwbox[2].txt
Risk: Medium
Name: TrackingCookie.Linksynergy
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@linksynergy[1].txt
Risk: Medium
Name: TrackingCookie.Mediaplex
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@mediaplex[2].txt
Risk: Medium
Name: TrackingCookie.Overture
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@overture[1].txt
Risk: Medium
Name: TrackingCookie.Paycounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@paycounter[2].txt
Risk: Medium
Name: TrackingCookie.Overture
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Wegcash
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Qksrv
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@qksrv[1].txt
Risk: Medium
Name: TrackingCookie.Questionmarket
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@questionmarket[1].txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@serving-sys[1].txt
Risk: Medium
Name: TrackingCookie.Sexcounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@sexcounter[1].txt
Risk: Medium
Name: TrackingCookie.Sexlist
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@sexlist[2].txt
Risk: Medium
Name: TrackingCookie.Starware
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@starware[2].txt
Risk: Medium
Name: TrackingCookie.Onestat
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Statcounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@statcounter[1].txt
Risk: Medium
Name: TrackingCookie.Webtrendslive
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Coremetrics
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Trafficmp
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@trafficmp[1].txt
Risk: Medium
Name: TrackingCookie.Tribalfusion
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@tribalfusion[2].txt
Risk: Medium
Name: TrackingCookie.Valueclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@valueclick[1].txt
Risk: Medium
Name: TrackingCookie.Valueclick
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@valueclick[3].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Web-stat
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@webstat[1].txt
Risk: Medium
Name: TrackingCookie.Burstbeacon
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Myaffiliateprogram
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][2].txt
Risk: Medium
Name: TrackingCookie.Web-stat
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Xxxcounter
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@xxxcounter[2].txt
Risk: Medium
Name: TrackingCookie.Esomniture
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@y-1shz2prbmdj6wvny-1sez2pra2dj6wjliclczakpa6dj6x9ny-1seq-2-2.stats.esomniture[2].txt
Risk: Medium
Name: TrackingCookie.Yadro
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@yadro[1].txt
Risk: Medium
Name: TrackingCookie.Adserver
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.Zedo
Path: C:\Documents and Settings\Gary Lee\Application Data\Earthlink\6.0\[email protected]\Cookies\gary lee@zedo[2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.26:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.27:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.28:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.29:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.30:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.31:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.32:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.33:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.34:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.35:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: :mozilla.36:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: :mozilla.37:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: :mozilla.38:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Pointroll
Path: :mozilla.39:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Burstnet
Path: :mozilla.63:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Com
Path: :mozilla.67:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Com
Path: :mozilla.68:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Sexcounter
Path: :mozilla.70:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Sexcounter
Path: :mozilla.71:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: :mozilla.77:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Clickzs
Path: :mozilla.78:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Ru4
Path: :mozilla.86:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Ru4
Path: :mozilla.87:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Ru4
Path: :mozilla.88:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.138:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Overture
Path: :mozilla.152:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Overture
Path: :mozilla.153:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Overture
Path: :mozilla.163:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Qksrv
Path: :mozilla.165:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Qksrv
Path: :mozilla.166:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: :mozilla.184:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: :mozilla.185:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: :mozilla.186:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: :mozilla.187:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: :mozilla.188:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Statcounter
Path: :mozilla.189:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Statcounter
Path: :mozilla.190:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Statcounter
Path: :mozilla.191:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Tribalfusion
Path: :mozilla.194:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Adserver
Path: :mozilla.204:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Adserver
Path: :mozilla.205:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: :mozilla.214:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: :mozilla.215:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.Liveperson
Path: :mozilla.216:C:\Documents and Settings\Gary Lee\Application Data\Phoenix\Profiles\default\1y1lhwpm.slt\cookies.txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@2o7[2].txt
Risk: Medium
Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@atdmt[1].txt
Risk: Medium
Name: TrackingCookie.Clickbank
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@clickbank[1].txt
Risk: Medium
Name: TrackingCookie.Com
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@com[1].txt
Risk: Medium
Name: TrackingCookie.Cpvfeed
Path: C:\Documents and Settings\Gary Lee\Cookies\gary lee@cpvfeed[2].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Cookies\gary [email protected][1].txt
Risk: Medium
Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Gary Lee\Local Settings\Temp\Cookies\gary [email protected][1].txt
Risk: Medium
Name: Not-A-Virus.Hoax.Win32.Renos.ec
Path: C:\Documents and Settings\Gary Lee\Local Settings\Temp\tmp76.tmp
Risk: Low
Name: Adware.SpywareQuake
Path: C:\Documents and Settings\Gary Lee\Start Menu\Programs\SpyQuake2.com
Risk: Medium
Name: Trojan.Small
Path: C:\Program Files\Media-Codec
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\iesuninst.exe
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\isauninst.exe
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\ot.ico
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\pmsngr.exe
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\pmuninst.exe
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\ts.ico
Risk: High
Name: Trojan.Small
Path: C:\Program Files\Media-Codec\uninst.exe
Risk: High
SmitFraudFix v2.83
Scan done at 13:53:56.58, Tue 09/05/2006
Run from C:\Documents and Settings\Gary Lee\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\DOCUME~1\GARYLE~1\STARTM~1\Programs\SpyQuake2.com Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
C:\Program Files\Media-Codec\ Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
Logfile of HijackThis v1.99.1
Scan saved at 2:14:58 PM, on 9/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\HPConfig.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\Agent\mcupdui.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\ISP.COM High Speed\slipcore.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISP.COM High Speed\slipgui.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\vso\mcmnhdlr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Gary Lee\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presari...t...c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presari...t...c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5404
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ISP.COM High Speed\PBHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ISP.COM High Speed - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ISP.COM High Speed\Toolband.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\ISP.COM High Speed\slipcore.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ISP.COM High Speed.lnk = C:\Program Files\ISP.COM High Speed\slipgui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/327
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/328
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Advisor - {460692F5-B18A-4EBB-AE05-1B321C876AA2} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {272D793A-7AE3-5867-D25D-354B634AFCDC} - http://85.255.113.214/1/gdnUS2218.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akama...meInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E26BB9F-3DB2-454F-898D-76CFE0BCA589}: NameServer = 63.93.96.20 63.93.96.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E26BB9F-3DB2-454F-898D-76CFE0BCA589}: NameServer = 63.93.96.20 63.93.96.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
#6
Posted 05 September 2006 - 05:55 PM
Hello again
I am not sure why you can't run Ewido from your PC, but I can see the on-line results.
Rescan with HijackThis. Close all programmes leaving only HijackThis running. Place a checkmark or tick against the following:
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Advisor - {460692F5-B18A-4EBB-AE05-1B321C876AA2} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {272D793A-7AE3-5867-D25D-354B634AFCDC} - http://85.255.113.214/1/gdnUS2218.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akama...meInstaller.exe
Click on Fix Checked when finished and exit HijackThis.
Post back a fresh HijackThis log, from normal mode, and I will take another look. How's the PC running now?
I am not sure why you can't run Ewido from your PC, but I can see the on-line results.
Rescan with HijackThis. Close all programmes leaving only HijackThis running. Place a checkmark or tick against the following:
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Advisor - {460692F5-B18A-4EBB-AE05-1B321C876AA2} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O16 - DPF: {272D793A-7AE3-5867-D25D-354B634AFCDC} - http://85.255.113.214/1/gdnUS2218.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akama...meInstaller.exe
Click on Fix Checked when finished and exit HijackThis.
Post back a fresh HijackThis log, from normal mode, and I will take another look. How's the PC running now?
#7
Posted 06 September 2006 - 07:37 AM
Mr. Crusty, thanks again for your time & help. I have followed your instructions and reposted my HTL. And as far as my computer running, it has always run ok, just had those annoying pop-ups. They seem to go dormant for periods, but resurface. They are not present today!
Logfile of HijackThis v1.99.1
Scan saved at 6:29:10 AM, on 9/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\HPConfig.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\ISP.COM High Speed\slipcore.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISP.COM High Speed\slipgui.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\vso\mcmnhdlr.exe
C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
C:\PROGRA~1\McAfee.com\Agent\mcupdui.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Gary Lee\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presari...t...c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presari...t...c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ISP.COM High Speed\PBHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ISP.COM High Speed - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ISP.COM High Speed\Toolband.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\ISP.COM High Speed\slipcore.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ISP.COM High Speed.lnk = C:\Program Files\ISP.COM High Speed\slipgui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
Logfile of HijackThis v1.99.1
Scan saved at 6:29:10 AM, on 9/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\HPConfig.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\ISP.COM High Speed\slipcore.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISP.COM High Speed\slipgui.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\vso\mcmnhdlr.exe
C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
C:\PROGRA~1\McAfee.com\Agent\mcupdui.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Gary Lee\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presari...t...c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presari...t...c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ISP.COM High Speed\PBHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ISP.COM High Speed - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ISP.COM High Speed\Toolband.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\ISP.COM High Speed\slipcore.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ISP.COM High Speed.lnk = C:\Program Files\ISP.COM High Speed\slipgui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
#8
Posted 06 September 2006 - 09:25 AM
Congratulations! your new log is clean. Just a little bit more to do to prevent further infection.
Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)
To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.
(Windows XP)
1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.
3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
I recommend going to the following link and update as recommended by Microsoft. This adds more security and extra features including a pop-up blocker for Internet Explorer. Microsoft Update
MVPS Hosts file This replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
SiteAdvisor download this plug-in for your browser and it will alert you of a known bad site for FREE.
Now that everything is fixed, I suggest that you consider getting these programmes to help keep the computer clean:
SPYWARE BLASTER - Blocks bad ActiveX items from installing on your computer.
WINDOWS DEFENDER - With daily updates and scans, this programme offers good security against malware.
AD-AWARE PERSONAL – A fine free malware detector and removal programme
SPYBOT S&D – Excellent free spyware detector and removal programme
GOOGLE TOOLBAR - Blocks many unwanted pop-ups in Internet Explorer.
FIREFOX - Safer alternative to the Internet Explorer web browser.
AVG ANTIVIRUS FREE EDITION - Free antivirus programme if you currently are not using one.
ZONEALARM - Free firewall programme if you currently are not using one (Windows XP has a built-in firewall).
Remember to update these frequently.
Please note that whilst there is nothing wrong in having more than one antispyware programme for “on demand” scanning, having two or more antivirus systems is not recommended as they may well cause conflicts and slowness.
You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.
Be sure to keep your Windows, antispyware and antivirus updated.
Your active X problem is probably due to security settings being too high. To correct this: In MSIE go to TOOLS > INTERNET OPTIONS > SECURITY > and set all four zones at DEFAULT LEVEL by pressing the DEFAULT button > APPLY > OK.
It just remains for me to wish you happy safe surfing; I hope you found my advice helpful.
Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)
To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.
(Windows XP)
1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.
3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
I recommend going to the following link and update as recommended by Microsoft. This adds more security and extra features including a pop-up blocker for Internet Explorer. Microsoft Update
MVPS Hosts file This replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
SiteAdvisor download this plug-in for your browser and it will alert you of a known bad site for FREE.
Now that everything is fixed, I suggest that you consider getting these programmes to help keep the computer clean:
SPYWARE BLASTER - Blocks bad ActiveX items from installing on your computer.
WINDOWS DEFENDER - With daily updates and scans, this programme offers good security against malware.
AD-AWARE PERSONAL – A fine free malware detector and removal programme
SPYBOT S&D – Excellent free spyware detector and removal programme
GOOGLE TOOLBAR - Blocks many unwanted pop-ups in Internet Explorer.
FIREFOX - Safer alternative to the Internet Explorer web browser.
AVG ANTIVIRUS FREE EDITION - Free antivirus programme if you currently are not using one.
ZONEALARM - Free firewall programme if you currently are not using one (Windows XP has a built-in firewall).
Remember to update these frequently.
Please note that whilst there is nothing wrong in having more than one antispyware programme for “on demand” scanning, having two or more antivirus systems is not recommended as they may well cause conflicts and slowness.
You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.
Be sure to keep your Windows, antispyware and antivirus updated.
Your active X problem is probably due to security settings being too high. To correct this: In MSIE go to TOOLS > INTERNET OPTIONS > SECURITY > and set all four zones at DEFAULT LEVEL by pressing the DEFAULT button > APPLY > OK.
It just remains for me to wish you happy safe surfing; I hope you found my advice helpful.
#9
Posted 06 September 2006 - 09:51 AM
You are a savior!
Does this mean all the bad stuff in the ewido report was removed?
And a donation is forthcoming via PayPal!
Does this mean all the bad stuff in the ewido report was removed?
And a donation is forthcoming via PayPal!
#10
Posted 06 September 2006 - 11:19 AM
Yes Gary, it does. But if you have managed to reset your security zones, why not download Ewido with a 30-day free trial. After 30 days you have to manually update it for "on demand" scanning, but that takes all of 5 seconds. These days you need an antimalware scanner as well as an antivirus scanner.
I'll leave this thread open for a few days in case of misfortune.
I'll leave this thread open for a few days in case of misfortune.
#11
Posted 06 September 2006 - 01:26 PM
Thank you for your generosity.
#12
Posted 16 September 2006 - 07:24 AM
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users