Here is the log from the ewido scan
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 8:15:55 AM, 5/12/2005
+ Report-Checksum: 7944D017
+ Date of database: 5/11/2005
+ Version of scan engine: v3.0
+ Duration: 899 min
+ Scanned Files: 220482
+ Speed: 4.08 Files/Second
+ Infected files: 230
+ Removed files: 113
+ Files put in quarantine: 113
+ Files that could not be opened: 0
+ Files that could not be cleaned: 117
+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes
+ Scanned items:
C:\
D:\
C:\
D:\
+ Scan result:
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@abcsearch[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@advertising[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@atdmt[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@bfast[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@bluestreak[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@burstnet[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@burstnet[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@burstnet[4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@cgi-bin[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@doubleclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@geocities[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@geocities[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@hitbox[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@html[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@link[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@list[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@mediaplex[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@myway[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@ProPickZ[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@p[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@real[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@sextracker[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@tribalfusion[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\andrew@wt50[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\FAE\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\LRV\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\MBV\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\MVV\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\NQE\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\QEW\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\RBX\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\SZP\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\VCO\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temp\YDJ\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temporary Internet Files\Content.IE5\3O10VWG7\Video_Strip_Poker_v1[1].40.zip/khf.exe -> TrojanDownloader.INService.i -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temporary Internet Files\Content.IE5\C5E3KXE3\aurora[1].exe -> Spyware.BetterInternet.c -> Cleaned with backup
C:\Documents and Settings\Andrew\Local Settings\Temporary Internet Files\Content.IE5\CP670DIF\Nail[1].exe -> Trojan.Nail -> Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@burstnet[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@exitexchange[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\01FDD948-857B-4716-9D33-3A45C0\9891CA42-7D1F-4168-B329-94EE5C -> Spyware.BetterInternet -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072179.exe -> Trojan.Agent.cp -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072180.exe -> Trojan.Agent.cp -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072227.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072228.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072229.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072237.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072246.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072250.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072255.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072259.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00072643.exe -> Trojan.Agent.cp -> Cleaned with backup
C:\RECYCLER\NPROTECT\00073070.exe -> Trojan.Agent.cp -> Cleaned with backup
C:\RECYCLER\NPROTECT\00073555.exe -> Trojan.Agent.cp -> Cleaned with backup
C:\RECYCLER\NPROTECT\00073565.exe -> Trojan.Agent.cp -> Cleaned with backup
C:\RECYCLER\NPROTECT\00074850.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00074851.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00074852.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00074853.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00074876.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00074877.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00074878.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\RECYCLER\NPROTECT\00074879.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\WINDOWS\aqqcgnjesp.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\WINDOWS\Nail.exe -> Trojan.Nail -> Cleaned with backup
C:\WINDOWS\system32\Ldrwta.exe -> Trojan.Popmon.a -> Cleaned with backup
C:\WINDOWS\system32\Nzirja.exe -> Trojan.Popmon.a -> Cleaned with backup
C:\WINDOWS\system32\Stspac.exe -> Trojan.Popmon.a -> Cleaned with backup
C:\WINDOWS\system32\Wwgeku.exe -> Trojan.Popmon.a -> Cleaned with backup
C:\WINDOWS\Temp\DrTemp\bho_prob.exe -> Spyware.BetterInternet -> Error during cleaning
D:\RECYCLER\NPROTECT\00011638.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011641.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011645.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011655.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011657.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011687.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011688.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011689.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011715.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011716.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011717.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011769.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\RECYCLER\NPROTECT\00011770.TXT -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@abcsearch[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@advertising[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@atdmt[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@bfast[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@bluestreak[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@burstnet[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@burstnet[3].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@burstnet[4].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@cgi-bin[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@doubleclick[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@geocities[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@geocities[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@hitbox[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@html[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@link[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@list[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@mediaplex[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@myway[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@ProPickZ[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@p[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][3].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@real[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][3].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@sextracker[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@tribalfusion[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\andrew@wt50[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\FAE\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\LRV\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\MBV\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\MVV\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\NQE\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\QEW\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\RBX\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\SZP\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\VCO\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temp\YDJ\aurareco.exe -> Spyware.BetterInternet -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temporary Internet Files\Content.IE5\3O10VWG7\Video_Strip_Poker_v1[1].40.zip/khf.exe -> TrojanDownloader.INService.i -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temporary Internet Files\Content.IE5\C5E3KXE3\aurora[1].exe -> Spyware.BetterInternet.c -> Error during cleaning
C:\Documents and Settings\Andrew\Local Settings\Temporary Internet Files\Content.IE5\CP670DIF\Nail[1].exe -> Trojan.Nail -> Error during cleaning
C:\Documents and Settings\LocalService\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\LocalService\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\LocalService\Cookies\system@burstnet[2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\LocalService\Cookies\system@exitexchange[1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\LocalService\Cookies\
[email protected][1].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Documents and Settings\LocalService\Cookies\
[email protected][2].txt -> Spyware.Tracking-Cookie -> Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\01FDD948-857B-4716-9D33-3A45C0\9891CA42-7D1F-4168-B329-94EE5C -> Spyware.BetterInternet -> Error during cleaning
C:\RECYCLER\NPROTECT\00072179.exe -> Trojan.Agent.cp -> Error during cleaning
C:\RECYCLER\NPROTECT\00072180.exe -> Trojan.Agent.cp -> Error during cleaning
C:\RECYCLER\NPROTECT\00072227.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00072228.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00072229.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00072237.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00072246.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00072250.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00072255.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00072259.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00072643.exe -> Trojan.Agent.cp -> Error during cleaning
C:\RECYCLER\NPROTECT\00073070.exe -> Trojan.Agent.cp -> Error during cleaning
C:\RECYCLER\NPROTECT\00073555.exe -> Trojan.Agent.cp -> Error during cleaning
C:\RECYCLER\NPROTECT\00073565.exe -> Trojan.Agent.cp -> Error during cleaning
C:\RECYCLER\NPROTECT\00074850.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00074851.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00074852.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00074853.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00074876.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00074877.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00074878.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\RECYCLER\NPROTECT\00074879.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
C:\WINDOWS\aqqcgnjesp.exe -> Spyware.BetterInternet -> Error during cleaning
C:\WINDOWS\Nail.exe -> Trojan.Nail -> Error during cleaning
C:\WINDOWS\system32\Ldrwta.exe -> Trojan.Popmon.a -> Error during cleaning
C:\WINDOWS\system32\Nzirja.exe -> Trojan.Popmon.a -> Error during cleaning
C:\WINDOWS\system32\Stspac.exe -> Trojan.Popmon.a -> Error during cleaning
C:\WINDOWS\system32\Wwgeku.exe -> Trojan.Popmon.a -> Error during cleaning
C:\WINDOWS\Temp\DrTemp\bho_prob.exe -> Spyware.BetterInternet -> Error during cleaning
D:\RECYCLER\NPROTECT\00011638.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011641.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011645.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011655.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011657.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011687.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011688.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011689.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011715.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011716.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011717.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011769.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
D:\RECYCLER\NPROTECT\00011770.TXT -> Spyware.Tracking-Cookie -> Error during cleaning
::Report End
And here is the scan from Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 8:28:28 AM, on 5/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Real\RealOne Player\RealPlay.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PopUpStopperProfessional.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Andrew\My Documents\My Programs\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.my.msn.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealOne Player\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [PSoft1] C:\WINDOWS\system32\psoft1.exe
O4 - HKLM\..\Run: [Ad-watch] C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [clegnre] C:\WINDOWS\system32\wuceds\clegnre.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [PopUpStopperProfessional] C:\PROGRA~1\PANICW~1\POP-UP~2\PopUpStopperProfessional.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2F5B39C5-C6F5-447A-A946-48B382C53985} -
http://www.pacimedia...ll/pcs_0013.exeO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://v5.windowsupd...b?1112054507812O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: clegnrewuceds - Unknown owner - C:\WINDOWS\system32\wuceds\clegnre.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Now what?