Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Logfile of HijackThis/AVG Anti-Spyware - Scan Report

Started by NYMommy79 , Jan 03 2007 12:14 PM

Please log in to reply

#1
NYMommy79

Posted 03 January 2007 - 12:14 PM

New Member

Member
4 posts

Logfile of HijackThis v1.99.1
Scan saved at 1:10:34 PM, on 1/3/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Family Computer\Local Settings\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {2FD3178A-D84A-8F97-3E84-87AD0E0EB7C0} - C:\WINDOWS\System32\ikuwmmy.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1FEBB8FC-7B39-7ABF-1B76-78923D5ED1C4} - C:\WINDOWS\System32\nhdewvue.dll (file missing)
O2 - BHO: (no name) - {2FD3178A-D84A-8F97-3E84-87AD0E0EB7C0} - C:\WINDOWS\System32\ikuwmmy.dll (file missing)
O2 - BHO: (no name) - {40A2988E-C954-4DDE-BD08-453191805BB9} - C:\WINDOWS\system32\durvily.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {A3454B6D-8FFC-8572-D6AF-D528960464CA} - C:\WINDOWS\System32\zvzfzfa.dll (file missing)
O2 - BHO: (no name) - {B8D597C4-095D-0186-23F0-0045000D7196} - C:\WINDOWS\System32\rtz.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O2 - BHO: (no name) - {FCBEEA92-7204-7583-7435-2CD7397E6497} - C:\WINDOWS\System32\qgftxn.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [furi] C:\PROGRA~1\COMMON~1\furi\furim.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Icatch(VI) SnapDetect.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Family Computer - 07-01-02 15:52:40.45 Service Pack 1
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Family Computer\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Program Files\Cowabanga
C:\Program Files\Ipwins
C:\Program Files\Common Files\{34BC3595-09DF-1033-0103-060416200001}
C:\Program Files\Inetget2
C:\Program Files\network monitor
C:\Program Files\Common Files\{54BC3595-09DF-1033-0103-060416200001}
C:\WINDOWS\TG9yaWUgTGluYW1lbg

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Family Computer\Application Data\ECURIT~1
C:\QooBox\Purity\Program Files\SSTEM3~1
C:\QooBox\Purity\Program Files\Common Files\ASKS~1
C:\QooBox\Purity\WINDOWS\ICROSO~1
C:\QooBox\Purity\WINDOWS\system32\DOBE~1
C:\QooBox\Purity\WINDOWS\system32\MANTEC~1
C:\QooBox\Purity\WINDOWS\system32\SCURIT~1
C:\QooBox\Purity\WINDOWS\system32\SMBOLS~1
C:\QooBox\Purity\WINDOWS\system32\SSEMBL~1

((((((((((((((((((((((((((((((( Files Created from 2006-12-02 to 2007-01-02 ))))))))))))))))))))))))))))))))))

2007-01-02 15:52 <DIR> d-------- C:\Program Files\Ipwindows
2006-12-20 23:39 <DIR> d-------- C:\Documents and Settings\Family Computer\Application Data\Help
2006-12-20 15:20 45,056 --a------ C:\WINDOWS\system32\regapi.exe
2006-12-19 12:16 121,856 --a-s---- C:\WINDOWS\system32\druidy_redux.exe
2006-12-12 21:33 66,048 --a------ C:\WINDOWS\system32\durvily.dll
2006-12-12 21:33 121,856 --a-s---- C:\WINDOWS\system32\druidy_a4m.exe
2006-12-12 21:33 121,856 --a------ C:\WINDOWS\system32\durvily.exe
2006-12-08 21:29 <DIR> d-------- C:\WINDOWS\pss
2006-12-02 10:57 <DIR> d-------- C:\WINDOWS\furi
2006-12-02 10:57 <DIR> d-------- C:\Program Files\Common Files\furi

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-01-02 15:54 -------- d-------- C:\Program Files\Common Files
2007-01-01 11:47 -------- d-------- C:\Program Files\Java
2006-12-28 14:51 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\LimeWire
2006-12-15 12:40 -------- d---s---- C:\Documents and Settings\Family Computer\Application Data\Microsoft
2006-12-03 10:50 69 --a-s---- C:\WINDOWS\test.bat
2006-12-03 10:11 -------- d-------- C:\Program Files\Google
2006-11-30 10:25 -------- d-------- C:\Program Files\àppPatch
2006-11-24 21:51 -------- d-------- C:\Program Files\Common Files\Nullsoft
2006-11-24 16:07 -------- d-------- C:\Program Files\Yahoo!
2006-11-24 00:55 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\Mozilla
2006-11-23 20:50 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\Google
2006-11-23 10:35 28672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys
2006-11-20 17:39 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\Adobe
2006-11-20 17:31 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\AdobeUM
2006-11-19 16:32 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\Sun
2006-11-16 20:46 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\Lavasoft
2006-11-16 20:38 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-16 20:38 -------- d-------- C:\Program Files\NewSoft
2006-11-16 20:30 -------- d-------- C:\Program Files\DSC Driver
2006-11-16 20:30 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-11-16 20:22 -------- d-------- C:\Program Files\Microsoft Visual Studio
2006-11-16 20:22 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-11-16 20:22 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-11-16 20:22 -------- d-------- C:\Program Files\Common Files\Designer
2006-11-16 20:21 -------- d-------- C:\Program Files\Microsoft Office
2006-11-16 20:21 -------- d-------- C:\Program Files\Common Files\System
2006-11-16 20:20 -------- d-------- C:\Program Files\Common Files\L&H
2006-11-16 20:16 -------- d-------- C:\Program Files\LimeWire
2006-11-16 20:13 -------- d-------- C:\Program Files\Common Files\Java
2006-11-16 20:12 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\Macromedia
2006-11-16 20:10 -------- d-------- C:\Program Files\Dell Games
2006-11-16 20:10 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\WildTangent
2006-11-16 20:07 -------- d-------- C:\Program Files\PopCap Games
2006-11-16 20:04 -------- d-------- C:\Program Files\After Dark Games
2006-11-16 19:59 -------- d-------- C:\Program Files\Ahead
2006-11-16 19:58 -------- d-------- C:\Program Files\Common Files\Ahead
2006-11-16 19:50 4608 --a------ C:\WINDOWS\system32\w95inf32.dll
2006-11-16 19:50 2272 --a------ C:\WINDOWS\system32\w95inf16.dll
2006-11-16 19:50 -------- d-------- C:\Program Files\Windows Media Player
2006-11-16 19:50 -------- d-------- C:\Program Files\CyberLink
2006-11-16 19:48 -------- d-------- C:\Program Files\Lavasoft RegHance
2006-11-16 19:47 -------- d-------- C:\Program Files\Lavasoft
2006-11-16 19:47 -------- d-------- C:\Program Files\IrfanView
2006-11-16 19:31 -------- d-------- C:\Program Files\Kodak
2006-11-16 19:30 -------- d-------- C:\Program Files\Common Files\Kodak
2006-11-16 19:24 -------- d-------- C:\Program Files\Common Files\Adobe
2006-11-16 19:22 -------- d-------- C:\Program Files\Adobe
2006-11-16 19:18 -------- d-------- C:\Program Files\Norton AntiVirus
2006-11-16 19:16 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-11-16 19:11 -------- d-------- C:\Program Files\Symantec
2006-11-16 19:06 -------- d-------- C:\Program Files\SymNetDrv
2006-11-16 18:57 2397 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys
2006-11-16 18:57 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\Symantec
2006-11-16 18:52 -------- d-------- C:\Program Files\Intel
2006-11-16 18:51 -------- d-------- C:\Program Files\Dell
2006-11-16 18:40 -------- d-------- C:\Program Files\CONEXANT
2006-11-16 18:38 -------- d-------- C:\Program Files\Analog Devices
2006-11-16 18:33 -------- d-------- C:\Program Files\Messenger
2006-11-16 18:31 -------- d-------- C:\Program Files\Outlook Express
2006-11-16 18:31 -------- d-------- C:\Program Files\NetMeeting
2006-11-16 18:31 -------- d-------- C:\Program Files\Movie Maker
2006-11-16 18:31 -------- d-------- C:\Program Files\Internet Explorer
2006-11-16 18:09 -------- d--h----- C:\Program Files\Uninstall Information
2006-11-16 18:09 -------- d-------- C:\Documents and Settings\Family Computer\Application Data\Identities
2006-11-16 18:07 -------- d--h----- C:\Program Files\WindowsUpdate
2006-11-16 18:04 0 -rahs---- C:\MSDOS.SYS
2006-11-16 18:04 0 -rahs---- C:\IO.SYS
2006-11-16 18:04 0 --a------ C:\CONFIG.SYS
2006-11-16 18:04 0 --a------ C:\AUTOEXEC.BAT
2006-11-16 18:04 -------- d-------- C:\Program Files\xerox
2006-11-16 18:04 -------- d-------- C:\Program Files\microsoft frontpage
2006-11-16 18:03 -------- d-------- C:\Program Files\Online Services
2006-11-16 18:02 -------- d-------- C:\Program Files\Common Files\Services
2006-11-16 18:02 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-11-16 18:01 -------- d-------- C:\Program Files\ComPlus Applications
2006-11-16 18:00 -------- d-------- C:\Program Files\Windows NT
2006-11-16 18:00 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-11-16 12:56 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-11-16 12:56 -------- d-------- C:\Program Files\Common Files\ODBC
2006-11-16 12:55 62 --ahs---- C:\Documents and Settings\Family Computer\Application Data\desktop.ini

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 4:49:27 PM 1/2/2007

+ Scan result:

C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP20\A0004633.exe -> Adware.ClickSpring : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP20\A0004646.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0005996.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0005997.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006888.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006889.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004838.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004858.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP34\A0006192.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP35\A0006222.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP24\A0004767.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP24\A0004769.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004874.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP28\A0004971.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006019.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006042.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006044.EXE -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006053.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP34\A0006193.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP38\A0006375.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP38\A0006378.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP52\A0006767.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004837.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004839.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004840.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004841.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006055.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006056.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP36\A0006292.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006886.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006887.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00042532.dll -> Adware.TargetServer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0006008.dll -> Adware.TargetServer : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP44\A0006587.exe -> Downloader.Agent.axh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP45\A0006620.exe -> Downloader.Agent.axh : Cleaned with backup (quarantined).
C:\WINDOWS\system32\regapi.exe -> Downloader.Agent.axh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004947.EXE -> Downloader.Purit.co : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP20\A0004632.exe -> Downloader.PurityScan.bv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004842.exe -> Downloader.PurityScan.bv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004843.exe -> Downloader.PurityScan.bv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006054.exe -> Downloader.PurityScan.bv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006043.exe -> Downloader.PurityScan.co : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP20\A0004644.exe -> Downloader.PurityScan.da : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00041624.EXE -> Downloader.PurityScan.dy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP35\A0006223.EXE -> Downloader.PurityScan.dy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004844.EXE -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006051.EXE -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00042443.dll -> Downloader.Small.ece : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004859.dll -> Downloader.Small.ece : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0006000.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006049.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006059.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
C:\Program Files\Common Files\furi\furid\vocabulary -> Downloader.TSUpdate.j : Cleaned with backup (quarantined).
C:\Program Files\Common Files\furi\__delete_on_reboot__f_u_r_i_a_._e_x_e_ -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0006001.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006048.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006899.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00042529.exe -> Downloader.TSUpdate.n : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0006003.exe -> Downloader.TSUpdate.n : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006046.exe -> Downloader.TSUpdate.n : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006050.EXE -> Downloader.TSUpdate.o : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006047.exe -> Downloader.TSUpdate.p : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0006002.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006058.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00042444.exe -> Dropper.DollarR.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP26\A0004860.exe -> Dropper.DollarR.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0005999.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP40\A0006460.EXE -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Family Computer\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\index.jar-a8b7f2-73668ea1.zip/NewSecurityClassLoader.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\Family Computer\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\index.jar-a8b7f2-73668ea1.zip/NewURLClassLoader.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP20\A0004645.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP29\A0006009.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006885.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP10\A0004154.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP10\A0004156.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP10\A0004158.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP10\A0004162.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned with backup (quarantined).
:mozilla.622:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.403:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.414:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.560:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.562:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.563:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.564:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.565:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.566:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.567:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.409:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.411:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.412:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.167:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.168:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.169:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.170:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.484:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.503:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.638:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.639:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.640:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.641:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.642:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.643:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.644:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.645:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.477:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.478:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.479:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.480:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.481:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.623:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@bfast[1].txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.176:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.569:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.77:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.451:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.456:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.457:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.458:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.459:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.364:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.365:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.533:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.536:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.537:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.538:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.539:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.540:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.54:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.55:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.56:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.57:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.467:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.468:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.469:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.470:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.646:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@enhance[2].txt -> TrackingCookie.Enhance : Cleaned.
C:\RECYCLER\NPROTECT\00036085.TXT -> TrackingCookie.Enhance : Cleaned.
C:\RECYCLER\NPROTECT\00037018.TXT -> TrackingCookie.Enhance : Cleaned.
C:\RECYCLER\NPROTECT\00040603.TXT -> TrackingCookie.Enhance : Cleaned.
C:\RECYCLER\NPROTECT\00041906.TXT -> TrackingCookie.Enhance : Cleaned.
C:\RECYCLER\NPROTECT\00042182.TXT -> TrackingCookie.Enhance : Cleaned.
:mozilla.561:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.355:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.356:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.357:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.358:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.542:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.543:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.544:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.545:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.339:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.340:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.342:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.518:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.651:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00038116.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00038117.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00038118.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00038119.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00038120.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00038121.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@goclick[2].txt -> TrackingCookie.Goclick : Cleaned.
C:\RECYCLER\NPROTECT\00037193.TXT -> TrackingCookie.Goclick : Cleaned.
C:\RECYCLER\NPROTECT\00038108.TXT -> TrackingCookie.Goclick : Cleaned.
:mozilla.360:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.460:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.461:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.513:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.519:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.595:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\NPROTECT\00041912.TXT -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\NPROTECT\00041913.TXT -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\NPROTECT\00041914.TXT -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\NPROTECT\00041915.TXT -> TrackingCookie.Hitbox : Cleaned.
:mozilla.367:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.368:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.369:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.487:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.84:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.502:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.338:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.252:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.253:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.254:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.334:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.386:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@overture[1].txt -> TrackingCookie.Overture : Cleaned.
:mozilla.473:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.474:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.475:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.476:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family [email protected][2].txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.73:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.74:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.11:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.12:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.7:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.8:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.59:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.60:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.61:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.62:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.63:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.64:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.65:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.66:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.612:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.613:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.626:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.186:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.187:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.188:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.189:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.190:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.389:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.390:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.391:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.392:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.393:C:\Documents and Settings\Family Computer\Application Data\Mozilla\Firefox\Profiles\m92iov3u.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\LocalService\Cookies\system@statcounter[1].txt -> Tracking

#2
sari

Posted 04 January 2007 - 12:50 PM

GeekU Admin

Community Leader
21,806 posts

NYMommy79,

Hi, and welcome to Geeks to Go. You still have some clean up we need to do, but you did make progress on your own. :whistling:

I see that you are running HijackThis from a temporary directory; please create a new folder for it (for example C:\Program Files\Hijackthis\Hijackthis.exe) and move the program into it. It is very important you do this, as Hijackthis creates backups that you don't want deleted!

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R3 - URLSearchHook: (no name) - {2FD3178A-D84A-8F97-3E84-87AD0E0EB7C0} - C:\WINDOWS\System32\ikuwmmy.dll (file missing)
O2 - BHO: (no name) - {1FEBB8FC-7B39-7ABF-1B76-78923D5ED1C4} - C:\WINDOWS\System32\nhdewvue.dll (file missing)
O2 - BHO: (no name) - {2FD3178A-D84A-8F97-3E84-87AD0E0EB7C0} - C:\WINDOWS\System32\ikuwmmy.dll (file missing)
O2 - BHO: (no name) - {40A2988E-C954-4DDE-BD08-453191805BB9} - C:\WINDOWS\system32\durvily.dll (file missing)
O2 - BHO: (no name) - {A3454B6D-8FFC-8572-D6AF-D528960464CA} - C:\WINDOWS\System32\zvzfzfa.dll (file missing)
O2 - BHO: (no name) - {B8D597C4-095D-0186-23F0-0045000D7196} - C:\WINDOWS\System32\rtz.dll (file missing)
O2 - BHO: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O2 - BHO: (no name) - {FCBEEA92-7204-7583-7435-2CD7397E6497} - C:\WINDOWS\System32\qgftxn.dll (file missing)
O4 - HKCU\..\Run: [furi] C:\PROGRA~1\COMMON~1\furi\furim.exe

Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode.

Show Hidden Files
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Please delete these folders using Windows Explorer(if present):

C:\Program Files\Ipwindows
C:\WINDOWS\furi
C:\Program Files\Common Files\furi

Please delete these files using Windows Explorer(if present):

C:\WINDOWS\system32\druidy_redux.exe
C:\WINDOWS\system32\durvily.dll
C:\WINDOWS\system32\druidy_a4m.exe
C:\WINDOWS\system32\durvily.exe

Hide Hidden Files
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Check the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

After that, Reboot.

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Please go HERE to run Panda's ActiveScan

Once you are on the Panda site click the Scan your PC button
A new window will open...click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
If it wants to install an ActiveX component allow it
Select either Home User or Company
Click the big Scan Now button
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Please post a new hijackthis log and the Activescan report.

Thanks,

sari

Edited by sari, 04 January 2007 - 12:52 PM.

#3
NYMommy79

Posted 05 January 2007 - 01:58 PM

New Member

Topic Starter
Member
4 posts

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 2:50:42 PM 1/5/2007

+ Scan result:

C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP55\A0006818.EXE -> Adware.ClickSpring : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP30\A0006052.EXE -> Adware.PurityScan : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006908.dll -> Adware.TargetServer : Cleaned.
C:\RECYCLER\NPROTECT\00042556.exe -> Downloader.Agent.axh : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006904.EXE -> Downloader.PurityScan.dy : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006905.dll -> Downloader.Small.ece : Cleaned.
C:\RECYCLER\NPROTECT\00042554 -> Downloader.TSUpdate.j : Cleaned.
C:\RECYCLER\NPROTECT\00042555._E_ -> Downloader.TSUpdate.l : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006907.exe -> Downloader.TSUpdate.n : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006906.exe -> Dropper.DollarR.b : Cleaned.
C:\RECYCLER\NPROTECT\00042568.TXT -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00042565.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00042566.TXT -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\RECYCLER\NPROTECT\00042569.TXT -> TrackingCookie.Atdmt : Cleaned.
C:\RECYCLER\NPROTECT\00042571.TXT -> TrackingCookie.Bfast : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\RECYCLER\NPROTECT\00042572.TXT -> TrackingCookie.Coremetrics : Cleaned.
C:\RECYCLER\NPROTECT\00042570.TXT -> TrackingCookie.Doubleclick : Cleaned.
C:\RECYCLER\NPROTECT\00042573.TXT -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\RECYCLER\NPROTECT\00042561.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00042562.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00042574.TXT -> TrackingCookie.Findwhat : Cleaned.
C:\RECYCLER\NPROTECT\00042575.TXT -> TrackingCookie.Goclick : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family [email protected][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family [email protected][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Family Computer\Cookies\family computer@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\NPROTECT\00042563.TXT -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\NPROTECT\00042564.TXT -> TrackingCookie.Hitbox : Cleaned.
C:\RECYCLER\NPROTECT\00042560.TXT -> TrackingCookie.Liveperson : Cleaned.
C:\RECYCLER\NPROTECT\00042567.TXT -> TrackingCookie.Ru4 : Cleaned.
C:\RECYCLER\NPROTECT\00042576.TXT -> TrackingCookie.Statcounter : Cleaned.
C:\RECYCLER\NPROTECT\00042557.EXE -> Trojan.Kolweb.j : Cleaned.
C:\RECYCLER\NPROTECT\00042558.EXE -> Trojan.Kolweb.j : Cleaned.
C:\RECYCLER\NPROTECT\00042559.exe -> Trojan.Kolweb.j : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006901.exe -> Trojan.Small : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006902.exe -> Trojan.Small : Cleaned.
C:\System Volume Information\_restore{2E472BD3-7D9F-42B2-BBA4-4B5086C34A9D}\RP58\A0006903.exe -> Trojan.Small : Cleaned.

::Report end

Logfile of HijackThis v1.99.1
Scan saved at 2:56:11 PM, on 1/5/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Family Computer\Local Settings\Temp\Temporary Directory 7 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Icatch(VI) SnapDetect.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

#4
NYMommy79

Posted 07 January 2007 - 08:52 PM

New Member

Topic Starter
Member
4 posts

#5
sari

Posted 08 January 2007 - 06:14 PM

GeekU Admin

Community Leader
21,806 posts

NYMommy79,

Your hijackthis log is clean now. Did you follow my instructions from the previous post on running Panda's activescan? I see you posted an AVG anti-spyware log, which cleaned up some things, but I'd like to see the log from Activescan also, if you have it.

Thanks,

sari