[Mami]

Hi everyone,

Can anyone take a look at my HijackThis logfile (or see the attached)? The computer is incredible slow and is using up to 100% CPU. Am afraid that the problems were caused because of a possible virus from an attachment.

Thanks in advance!!!

***

Logfile of HijackThis v1.99.1
Scan saved at 18:08:23, on 05/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrunsvc.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swagent.exe
C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrun.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swstrtr.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swsoc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Oxigen\bin\Oxigen.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\CASEMA~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\srserv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\alerter.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\My Download Files\Yahoo! Music Engine\ymetray.exe
C:\Program Files\Microsoft Office\Office\1043\msoffice.exe
C:\MYDOWN~1\MESSEN~1\YPager.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\zlcocard.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Eigenaar\Bureaublad\hijackthis\HijackThis.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\My Download Files\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\My Download Files\Common\yiesrvc.dll
O2 - BHO: (no name) - {601ED020-FB6C-11D3-87D8-0050DA59922B} - (no file)
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\My Download Files\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\My Download Files\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [OxigenClientAdmin] C:\Program Files\Oxigen\bin\Oxigen.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CASEMA~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Zango SiteFinder] "C:\Program Files\Zango SiteFinder\ZangoSiteFinder.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ymetray] "C:\My Download Files\Yahoo! Music Engine\YahooMusicEngine.exe" -preload
O4 - HKLM\..\Run: [Windows Installer] C:\WINDOWS\system32\ntdll.exe
O4 - HKLM\..\Run: [Windows Spooler] C:\WINDOWS\system32\spoolsv32.exe
O4 - HKLM\..\Run: [Windows DLL Host] C:\WINDOWS\system32\dllhost32.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [reggserv] C:\WINDOWS\reggserv.exe s
O4 - HKLM\..\Run: [srserv] C:\WINDOWS\srserv.exe s
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Yahoo! Pager] C:\My Download Files\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [sys32] C:\WINDOWS\alerter.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe
O4 - Global Startup: Casema Wanadoo Cable.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ymetray.lnk = C:\My Download Files\Yahoo! Music Engine\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\My Download Files\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\My Download Files\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\My Download Files\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\My Download Files\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\My Download Files\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {248AB1C0-50DB-4D82-A15D-2E694F30B4E4} (Inet4.CInet4) - http://srv4.mediaplu...nload/Inet4.CAB
O16 - DPF: {4E042DE6-8B87-11D3-AE7F-004033D24DBD} (HtmlHelpViewer.CViewerHtml) - http://srv4.mediaplu...lHelpViewer.CAB
O16 - DPF: {642F50E7-244A-11D5-956E-0040339BF4B0} (Inet1.CInet1) - http://srv4.mediaplu...nload/Inet1.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1136575934046
O16 - DPF: {9D23DDAA-D04A-4384-8C51-7B226626A14C} (IBarre0.CManag) - http://srv4.mediaplu...nload/ENIBP.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {D34D6048-E232-4889-B08C-AF4AFE87A6F6} (ENIInetTools.clsManager) - http://srv4.mediaplu...NIInetTools.CAB
O16 - DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} (CycloScopeLite Control) - http://www.cyclomedi...loScopeLite.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: alrsbatt.dll e1.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: zlcocard - C:\WINDOWS\system32\zlcocard.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrunsvc.exe
O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swagent.exe
O23 - Service: ColdFusion MX ODBC Server - Unknown owner - C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swstrtr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Attached Files

•  hijackthis_20061205.txt   11.27KB   172 downloads

[Advertisements]

Download AVG Anti-Spyware from http://www.ewido.net/en/download/ and save that file to your desktop. Note: This is NOT the Anti Virus from AVG.

When the trial period expires it becomes feature-limited freeware but is still worth keeping as a good on-demand scanner.
1. Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double click it to launch the set up program.
2. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
3. On the main screen select the icon "Update" then select the "Update now" link.
o Next select the "Start Update" button. The update will start and a progress bar will show the updates being installed.
4. Once the update has completed, select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
6. Under "Reports"
o Select "Automatically generate report after every scan"
o Un-Select "Only if threats were found"
Close AVG Anti-Spyware. Do Not run a scan just yet, we will run it in safe mode.
1. Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.

IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning as it may interfere with the scanning process:
2. Launch AVG Anti-Spyware by double clicking the icon on your desktop.
3. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
4. AVG will now begin the scanning process. Please be patient as this may take a little time.
Once the scan is complete, do the following:
5. If you have any infections you will be prompted. Then select "Apply all actions."
6. Next select the "Reports" icon at the top.
7. Select the "Save report as" button in the lower lef- hand of the screen and save it to a text file on your system (make sure to remember where you saved that file. This is important).
8. Close AVG Anti-Spyware and reboot your system back into Normal Mode.
Post the log from AVG and a new HiJack log

[MFDnSC]

Download AVG Anti-Spyware from http://www.ewido.net/en/download/ and save that file to your desktop. Note: This is NOT the Anti Virus from AVG.

When the trial period expires it becomes feature-limited freeware but is still worth keeping as a good on-demand scanner.
1. Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double click it to launch the set up program.
2. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
3. On the main screen select the icon "Update" then select the "Update now" link.
o Next select the "Start Update" button. The update will start and a progress bar will show the updates being installed.
4. Once the update has completed, select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
6. Under "Reports"
o Select "Automatically generate report after every scan"
o Un-Select "Only if threats were found"
Close AVG Anti-Spyware. Do Not run a scan just yet, we will run it in safe mode.
1. Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.

IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning as it may interfere with the scanning process:
2. Launch AVG Anti-Spyware by double clicking the icon on your desktop.
3. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
4. AVG will now begin the scanning process. Please be patient as this may take a little time.
Once the scan is complete, do the following:
5. If you have any infections you will be prompted. Then select "Apply all actions."
6. Next select the "Reports" icon at the top.
7. Select the "Save report as" button in the lower lef- hand of the screen and save it to a text file on your system (make sure to remember where you saved that file. This is important).
8. Close AVG Anti-Spyware and reboot your system back into Normal Mode.
Post the log from AVG and a new HiJack log

[Mami]

Thank you for your quick response. Please find the results below or in the attached files:

***

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 23:23:34 05/12/2006

+ Scan result:



C:\Program Files\Microsoft AntiSpyware\Quarantine\DDB2C702-BB6D-444A-853C-AF0E09\1180188D-0539-4F7C-B1F0-E38208 -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\DDB2C702-BB6D-444A-853C-AF0E09\2E74CBC0-896A-4E00-9E18-C91D58 -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\DDB2C702-BB6D-444A-853C-AF0E09\69D51DCB-789E-43E7-AD97-5AE848 -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE1.tmp\bdefdi.dll -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\AzEntretienCo -> Adware.Azesearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\AzEntretienCo\AzEntretien -> Adware.Azesearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AzEntretien.Loader -> Adware.Azesearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AzEntretien.Loader.1 -> Adware.Azesearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AzEntretien.Loader\CLSID -> Adware.Azesearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AzEntretien.Loader\CurVer -> Adware.Azesearch : Cleaned with backup (quarantined).
C:\SARI_Comp01\WINDOWS\system32\bdefdi.dll -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB} -> Adware.Generic : Cleaned with backup (quarantined).
C:\SARI_Comp01\Documents and Settings\Administrator\Local Settings\Temp\Hbinst.exe -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\SARI_Comp01\WINDOWS\system32\Hbinst.exe -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\SARI_Comp01\WINDOWS\SYSTEM\Update_Hosts.DLL -> Adware.IGetNet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Windows Installer -> Adware.PestTrap : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\02B50B50-0E25-4EB4-BC12-15DD83\EC608A93-2602-4910-9FAD-297FB1 -> Adware.WinAD : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\02B50B50-0E25-4EB4-BC12-15DD83\F150460F-219B-44F1-AC61-36AF8F -> Adware.WinAD : Cleaned with backup (quarantined).
C:\WINDOWS\installer[p2p-10148,de].exe -> Dialer.Intexdial : Cleaned with backup (quarantined).
C:\Documents and Settings\Eigenaar\Shared\Adobe Photoshop CS2 Crack\apcs2ge\Adobe Photoshop CS2 Patch.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned with backup (quarantined).
:mozilla.109:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.110:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.138:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.196:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.278:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.38:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.39:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.44:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.80:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][1].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][1].txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.275:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.276:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.277:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.72:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.9:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.17:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.26:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.27:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.28:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.36:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.37:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.38:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.39:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.40:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.41:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.42:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.42:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.43:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\SARI_Comp01\Documents and Settings\Administrator\Cookies\sari@com[2].txt -> TrackingCookie.Com : Cleaned.
:mozilla.10:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.11:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][1].txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.53:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.54:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.55:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.56:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.57:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.58:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.59:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.60:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.61:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.62:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.243:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.88:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.89:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.90:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.52:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.67:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.208:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.209:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.210:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.211:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][2].txt -> TrackingCookie.Planetactive : Cleaned.
:mozilla.11:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.12:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.13:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.14:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.15:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.271:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.272:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.273:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.274:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][2].txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.17:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.75:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.76:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.158:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.159:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.160:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.161:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.162:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.163:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.164:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.165:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][1].txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.97:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.98:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.265:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.266:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.268:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.269:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.270:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.10:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.12:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.176:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.260:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.261:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.151:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.152:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.153:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.99:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.141:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.142:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.168:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.169:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.48:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.49:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.216:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.84:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.85:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.15:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.16:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.18:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.19:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\m7oe8be3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.25:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.29:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.30:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.31:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.32:C:\Documents and Settings\Gast\Application Data\Mozilla\Firefox\Profiles\z54aoueu.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\[email protected][1].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Eigenaar\Shared\Adobe Photoshop CS2 KeyGen Serial Crack.zip/Adobe Photoshop CS Activator.exe -> Worm.Delf.bd : Cleaned with backup (quarantined).
C:\Documents and Settings\Eigenaar\Shared\Adobe Photoshop CS2 KeyGen Serial Crack\Adobe Photoshop CS Activator.exe -> Worm.Delf.bd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0042682.exe -> Worm.Warezov.df : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0043735.exe -> Worm.Warezov.df : Cleaned with backup (quarantined).
C:\WINDOWS\system32\zlcocard.exe -> Worm.Warezov.df : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0043692.exe -> Worm.Warezov.et : Cleaned with backup (quarantined).
C:\WINDOWS\system32\zlcocard.dll -> Worm.Warezov.et : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0040571.exe -> Worm.Warezov.gl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0040594.exe -> Worm.Warezov.gl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0040610.exe -> Worm.Warezov.gl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0041610.exe -> Worm.Warezov.gl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0041661.exe -> Worm.Warezov.gl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0041681.exe -> Worm.Warezov.gl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0041687.exe -> Worm.Warezov.gl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A43F01FF-65E7-4828-9C2B-1FDCF5133A36}\RP298\A0042679.dll -> Worm.Warezov.hm : Cleaned with backup (quarantined).


::Report end

***

And the new HijackThis log:

***

Logfile of HijackThis v1.99.1
Scan saved at 23:50:15, on 05/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrunsvc.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swagent.exe
C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrun.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swstrtr.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swsoc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Oxigen\bin\Oxigen.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\CASEMA~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\My Download Files\Yahoo! Music Engine\YahooMusicEngine.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\reggserv.exe
C:\WINDOWS\srserv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\alerter.exe
C:\Program Files\Casema SnelHelp\bin\mpbtn.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\My Download Files\Yahoo! Music Engine\ymetray.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Microsoft Office\Office\1043\msoffice.exe
C:\MYDOWN~1\MESSEN~1\YPager.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Eigenaar\Bureaublad\hijackthis\HijackThis.exe
C:\Documents and Settings\Eigenaar\Bureaublad\hijackthis\HijackThis.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\My Download Files\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\My Download Files\Common\yiesrvc.dll
O2 - BHO: (no name) - {601ED020-FB6C-11D3-87D8-0050DA59922B} - (no file)
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\My Download Files\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\My Download Files\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [OxigenClientAdmin] C:\Program Files\Oxigen\bin\Oxigen.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CASEMA~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Zango SiteFinder] "C:\Program Files\Zango SiteFinder\ZangoSiteFinder.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ymetray] "C:\My Download Files\Yahoo! Music Engine\YahooMusicEngine.exe" -preload
O4 - HKLM\..\Run: [Windows Spooler] C:\WINDOWS\system32\spoolsv32.exe
O4 - HKLM\..\Run: [Windows DLL Host] C:\WINDOWS\system32\dllhost32.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [reggserv] C:\WINDOWS\reggserv.exe s
O4 - HKLM\..\Run: [srserv] C:\WINDOWS\srserv.exe s
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Yahoo! Pager] C:\My Download Files\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [sys32] C:\WINDOWS\alerter.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe
O4 - Global Startup: Casema Wanadoo Cable.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ymetray.lnk = C:\My Download Files\Yahoo! Music Engine\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\My Download Files\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\My Download Files\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\My Download Files\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\My Download Files\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\My Download Files\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {248AB1C0-50DB-4D82-A15D-2E694F30B4E4} (Inet4.CInet4) - http://srv4.mediaplu...nload/Inet4.CAB
O16 - DPF: {4E042DE6-8B87-11D3-AE7F-004033D24DBD} (HtmlHelpViewer.CViewerHtml) - http://srv4.mediaplu...lHelpViewer.CAB
O16 - DPF: {642F50E7-244A-11D5-956E-0040339BF4B0} (Inet1.CInet1) - http://srv4.mediaplu...nload/Inet1.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1136575934046
O16 - DPF: {9D23DDAA-D04A-4384-8C51-7B226626A14C} (IBarre0.CManag) - http://srv4.mediaplu...nload/ENIBP.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {D34D6048-E232-4889-B08C-AF4AFE87A6F6} (ENIInetTools.clsManager) - http://srv4.mediaplu...NIInetTools.CAB
O16 - DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} (CycloScopeLite Control) - http://www.cyclomedi...loScopeLite.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: alrsbatt.dll e1.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: zlcocard - C:\WINDOWS\system32\zlcocard.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrunsvc.exe
O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swagent.exe
O23 - Service: ColdFusion MX ODBC Server - Unknown owner - C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swstrtr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

***

Please help...

Attached Files

•  Report_Scan_20061205_232334.txt   47.21KB   99 downloads
•  hijackthis_20061205_02.txt   11.8KB   155 downloads

[MFDnSC]

Your MS Antispware is out of date and has been replaced with

MS Windows Defender - http://www.microsoft...;displaylang=en (XP and W2K only)
==========================================
Is your Norton current??????????

+++++++++++++++++++

You may want to print this or save it to notepad as we will go to safe mode.

Fix these with HiJackThis – mark them, close IE, click fix checked

O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 –u

O4 - HKLM\..\Run: [Zango SiteFinder] "C:\Program Files\Zango SiteFinder\ZangoSiteFinder.exe"

O4 - HKLM\..\Run: [Windows Spooler] C:\WINDOWS\system32\spoolsv32.exe

O4 - HKLM\..\Run: [Windows DLL Host] C:\WINDOWS\system32\dllhost32.exe

O4 - HKLM\..\Run: [reggserv] C:\WINDOWS\reggserv.exe s

O4 - HKLM\..\Run: [srserv] C:\WINDOWS\srserv.exe s

O4 - HKCU\..\Run: [sys32] C:\WINDOWS\alerter.exe

O20 - AppInit_DLLs: alrsbatt.dll e1.dll

O20 - Winlogon Notify: zlcocard - C:\WINDOWS\system32\zlcocard.dll (file missing)

DownLoad http://www.downloads...org/KillBox.zip or
http://www.thespykil...les/killbox.exe

Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

C:\Program Files\Zango SiteFinder
C:\WINDOWS\system32\spoolsv32.exe
C:\WINDOWS\system32\dllhost32.exe
C:\WINDOWS\reggserv.exe
C:\WINDOWS\srserv.exe
C:\WINDOWS\alerter.exe
C:\WINDOWS\system32\alrsbatt.dll
C:\WINDOWS\system32\e1.dll

Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

START – RUN – type in %temp% - OK - Edit – Select all – File – Delete

Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

Not all temp files will delete and that is normal
Empty the recycle bin
Boot and post a new log from normal NOT safe mode

Please give feedback on what worked/didn’t work and the current status of your system

[Mami]

My Norton program does give me a constant warning that it discovered the virus but could not repair it. It could not delete the e1.dll file from the HijackThis program nor from the Killbox program.

Please find below the new HijackThis log:

***

Logfile of HijackThis v1.99.1
Scan saved at 11:43:42, on 06/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Oxigen\bin\Oxigen.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\CASEMA~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrunsvc.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swagent.exe
C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrun.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swstrtr.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swsoc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Casema SnelHelp\bin\mpbtn.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\My Download Files\Yahoo! Music Engine\ymetray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office\1043\msoffice.exe
C:\WINDOWS\system32\svchost.exe
C:\MYDOWN~1\MESSEN~1\YPager.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Eigenaar\Bureaublad\hijackthis\HijackThis.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\My Download Files\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\My Download Files\Common\yiesrvc.dll
O2 - BHO: (no name) - {601ED020-FB6C-11D3-87D8-0050DA59922B} - (no file)
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\My Download Files\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\My Download Files\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [OxigenClientAdmin] C:\Program Files\Oxigen\bin\Oxigen.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CASEMA~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ymetray] "C:\My Download Files\Yahoo! Music Engine\YahooMusicEngine.exe" -preload
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Yahoo! Pager] C:\My Download Files\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe
O4 - Global Startup: Casema Wanadoo Cable.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ymetray.lnk = C:\My Download Files\Yahoo! Music Engine\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\My Download Files\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\My Download Files\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\My Download Files\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\My Download Files\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\My Download Files\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {248AB1C0-50DB-4D82-A15D-2E694F30B4E4} (Inet4.CInet4) - http://srv4.mediaplu...nload/Inet4.CAB
O16 - DPF: {4E042DE6-8B87-11D3-AE7F-004033D24DBD} (HtmlHelpViewer.CViewerHtml) - http://srv4.mediaplu...lHelpViewer.CAB
O16 - DPF: {642F50E7-244A-11D5-956E-0040339BF4B0} (Inet1.CInet1) - http://srv4.mediaplu...nload/Inet1.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1136575934046
O16 - DPF: {9D23DDAA-D04A-4384-8C51-7B226626A14C} (IBarre0.CManag) - http://srv4.mediaplu...nload/ENIBP.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {D34D6048-E232-4889-B08C-AF4AFE87A6F6} (ENIInetTools.clsManager) - http://srv4.mediaplu...NIInetTools.CAB
O16 - DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} (CycloScopeLite Control) - http://www.cyclomedi...loScopeLite.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: e1.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrunsvc.exe
O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swagent.exe
O23 - Service: ColdFusion MX ODBC Server - Unknown owner - C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swstrtr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

***

Please, how do I get rid of it?

[MFDnSC]

You still have the out of date MS antispy - you did not answer the question of Norton is current


Fix that O20 entry again and then use the DELETE ON REBOOT option in killbox to delete

C:\WINDOWS\system32\e1.dll

[Mami]

I have Norton Antivirus 2003 with a yearly virusdefinition subscription that has expired a few months ago.

What I did now is I downloaded the Windows Defender, after that I will try your suggested steps again.

[Mami]

It still cannot remove the e1.dll file...

***

Logfile of HijackThis v1.99.1
Scan saved at 20:13:26, on 06/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrunsvc.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swagent.exe
C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrun.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swstrtr.exe
C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swsoc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Oxigen\bin\Oxigen.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\CASEMA~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft Office\Office\1043\msoffice.exe
C:\My Download Files\Yahoo! Music Engine\ymetray.exe
C:\Program Files\Casema SnelHelp\bin\mpbtn.exe
C:\MYDOWN~1\MESSEN~1\YPager.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Eigenaar\Bureaublad\hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\My Download Files\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\My Download Files\Common\yiesrvc.dll
O2 - BHO: (no name) - {601ED020-FB6C-11D3-87D8-0050DA59922B} - (no file)
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\My Download Files\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\My Download Files\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [OxigenClientAdmin] C:\Program Files\Oxigen\bin\Oxigen.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CASEMA~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ymetray] "C:\My Download Files\Yahoo! Music Engine\YahooMusicEngine.exe" -preload
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Yahoo! Pager] C:\My Download Files\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe
O4 - Global Startup: Casema Wanadoo Cable.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ymetray.lnk = C:\My Download Files\Yahoo! Music Engine\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\My Download Files\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\My Download Files\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\My Download Files\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\My Download Files\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\My Download Files\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {248AB1C0-50DB-4D82-A15D-2E694F30B4E4} (Inet4.CInet4) - http://srv4.mediaplu...nload/Inet4.CAB
O16 - DPF: {4E042DE6-8B87-11D3-AE7F-004033D24DBD} (HtmlHelpViewer.CViewerHtml) - http://srv4.mediaplu...lHelpViewer.CAB
O16 - DPF: {642F50E7-244A-11D5-956E-0040339BF4B0} (Inet1.CInet1) - http://srv4.mediaplu...nload/Inet1.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1136575934046
O16 - DPF: {9D23DDAA-D04A-4384-8C51-7B226626A14C} (IBarre0.CManag) - http://srv4.mediaplu...nload/ENIBP.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {D34D6048-E232-4889-B08C-AF4AFE87A6F6} (ENIInetTools.clsManager) - http://srv4.mediaplu...NIInetTools.CAB
O16 - DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} (CycloScopeLite Control) - http://www.cyclomedi...loScopeLite.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - C:\Program_Files\Macromedia\CFusionMX\runtime\bin\jrunsvc.exe
O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swagent.exe
O23 - Service: ColdFusion MX ODBC Server - Unknown owner - C:\Program_Files\Macromedia\CFusionMX\db\slserver52\bin\swstrtr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[MFDnSC]

That is not an Antivirus - uninstall Norton

Get the free AVG 7.5 install it, check for updates and run a full scan

AVG 7.5 - http://free.grisoft....eweb.php/doc/2/

See if it will get e1.dll

[Mami]

But that I did already, after your first reply.

Have you checked my previous HijackThis log? I cannot see e1.dll anymore.

[MFDnSC]

No you got the AntiSpyware - that new linkis the AntiVirus