[therock247uk]

Please find the file C:\Windows\wininit.ini copy and paste its contents here in a reply.

[Advertisements]

I don't seem to have this file. Closest thing I have is C:\windows\wininitlog.old

[cale42]

I don't seem to have this file. Closest thing I have is C:\windows\wininitlog.old

[therock247uk]

Do you have show all files and show system files on? look here for instructions on how to do this, http://www.xtra.co.n...1916458,00.html

[cale42]

Yes I have show all files and folders on.. I did a search on the whole hard drive for wininit and the above mentioned file was all that came back.

[therock247uk]

In C:\Windows\ is there a file called explorer.new?

Also find the file C:\Windows\explorer.exe and upload it to http://virusscan.jotti.org/ and tell me the results.

[cale42]

I don't see a file called explorer.new. I have one file that just says explorer with no file type and it is listed as a type 'Windows Explorer Command' and then I have explorer.exe.

Results from the scan of explorer.exe are as follows


Service load:
0% 100%
File: explorer.exe
Status:
INFECTED/MALWARE
MD5 fc891655bab46beb38de970998c36faa
Packers detected:
-
Scanner results
AntiVir
Found nothing
ArcaVir
Found W32.Bube.J
Avast
Found Win32:Bube-I
AVG Antivirus
Found nothing
BitDefender
Found Win32.Bube.L
ClamAV
Found W32.Bube.L
Dr.Web
Found modification of Win32.Beavis.5106
F-Prot Antivirus
Found nothing
Fortinet
Found W32/Bube.I
Kaspersky Anti-Virus
Found Virus.Win32.Bube.l
NOD32
Found Win32/Bube.L
Norman Virus Control
Found W32/Bube.L
VBA32
Found Win32.Worm.Bube.l

[therock247uk]

You have the virus called bube.L Follow all instructions here http://www.bleepingc...rvs-t11662.html

After post the log Kaspersky made and a new Hijackthis log.

[cale42]

Alright, thanks for you ongoing help and patience. Followed the instructions you pointed me too. Below is the HJT log.. followed by the Kaspersky log
cale

Logfile of HijackThis v1.99.1
Scan saved at 5:36:21 PM, on 6/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRAM FILES\WINAMP\winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\mc-58-12-0000093.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Common Files\services.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\ChrisA\Desktop\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\default\prefs.js)
O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program Files\DNS\Catcher.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\PROGRAM FILES\WINAMP\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000093.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes12031.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes12031.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et1_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt1_x.cab
O16 - DPF: Yahoo! Spades - http://download.game...nts/y/st2_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.co...ic/SimCityX.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe



Statistics:
Start time: 6/22/2005 4:42:11 PM
Completion time: 6/22/2005 5:22:18 PM
Objects scanned: 147646
Dangerous objects detected: 10
Viruses disinfected: 0
Objects deleted: 10
Objects quarantined: 0

Settings:
Objects to scan:
My Computer
If a dangerous object is detected:
Perform recommended action
Scan level:
Maximum Protection
Exclusions from the scan scope:
Option not used

Report:
C:\WINDOWS\drexinit.dll;is a Trojan Trojan.Win32.Agent.co;6/22/2005 4:42:56 PM
C:\WINDOWS\drexinit.dll;moved to the backup storage;6/22/2005 4:42:57 PM
C:\WINDOWS\drexinit.dll;deleted;6/22/2005 4:42:57 PM
C:\WINDOWS\inst\3p_2.exe/WISE0001.BIN;is a Trojan Trojan-Downloader.Win32.TSUpdate.f;6/22/2005 4:56:52 PM
C:\WINDOWS\inst\3p_2.exe;moved to the backup storage;6/22/2005 4:56:52 PM
C:\WINDOWS\inst\3p_2.exe;deleted;6/22/2005 4:56:52 PM
C:\Program Files\Microsoft AntiSpyware\Quarantine\64865801-04E3-4C87-BEB2-DBC844\A971FA2F-3486-404A-A4DE-BF2F46;is a Trojan Trojan-Downloader.Win32.Apropo.ad;6/22/2005 5:09:56 PM
C:\Program Files\Microsoft AntiSpyware\Quarantine\64865801-04E3-4C87-BEB2-DBC844\A971FA2F-3486-404A-A4DE-BF2F46;moved to the backup storage;6/22/2005 5:09:56 PM
C:\Program Files\Microsoft AntiSpyware\Quarantine\64865801-04E3-4C87-BEB2-DBC844\A971FA2F-3486-404A-A4DE-BF2F46;deleted;6/22/2005 5:09:56 PM
C:\Program Files\Microsoft AntiSpyware\Quarantine\60A8D684-D84A-4E3F-9C76-FC4BAE\2C570D67-4EEB-4684-BF13-417BAB;is a Trojan Trojan-Downloader.Win32.Apropo.ad;6/22/2005 5:09:58 PM
C:\Program Files\Microsoft AntiSpyware\Quarantine\60A8D684-D84A-4E3F-9C76-FC4BAE\2C570D67-4EEB-4684-BF13-417BAB;moved to the backup storage;6/22/2005 5:09:58 PM
C:\Program Files\Microsoft AntiSpyware\Quarantine\60A8D684-D84A-4E3F-9C76-FC4BAE\2C570D67-4EEB-4684-BF13-417BAB;deleted;6/22/2005 5:09:58 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\Ad-Aware SE Default.skn;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\arrow1.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\arrow2.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bck1.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt11.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt12.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt13.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt21.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt22.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt23.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt31.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt32.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt33.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt41.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt42.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt43.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt51.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt52.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt53.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt61.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt62.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\checkbox1.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\checkbox2.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\checkbox3.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\checkbox4.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\defbtn1.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\defbtn2.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\defbtn3.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph1.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph2.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph3.bmp;password protected, has not been processed;6/22/2005 5:15:50 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph4.bmp;password protected, has not been processed;6/22/2005 5:15:51 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph5.bmp;password protected, has not been processed;6/22/2005 5:15:51 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph6.bmp;password protected, has not been processed;6/22/2005 5:15:51 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph7.bmp;password protected, has not been processed;6/22/2005 5:15:51 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\main.bmp;password protected, has not been processed;6/22/2005 5:15:51 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\preview.bmp;password protected, has not been processed;6/22/2005 5:15:51 PM
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\sprite1.bmp;password protected, has not been processed;6/22/2005 5:15:51 PM
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0002;is a Trojan Trojan.Win32.Scapur.g;6/22/2005 5:16:45 PM
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe;moved to the backup storage;6/22/2005 5:16:45 PM
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe;is a Trojan Trojan.Win32.Scapur.g;6/22/2005 5:16:45 PM
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe;deleted;6/22/2005 5:16:45 PM
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0002;is a Trojan Trojan.Win32.Scapur.g;6/22/2005 5:16:46 PM
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe;moved to the backup storage;6/22/2005 5:16:46 PM
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe;is a Trojan Trojan.Win32.Scapur.g;6/22/2005 5:16:46 PM
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe;deleted;6/22/2005 5:16:46 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DoubleClick4.zip\chrisa@doubleclick[4].txt;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DoubleClick4.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdMonitor.zip\chrisa@admonitor[1].txt;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdMonitor.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast4.zip\chris@bfast[1].txt;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast4.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast5.zip\chris@bfast[2].txt;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast5.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdMonitor1.zip\chrisa@admonitor[3].txt;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdMonitor1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop.zip\main_02.gif;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:55 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy1.zip\favicon.ico;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy1.zip\bbsmartstubfal.exe;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy1.zip\bbsmartsetup.exe;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy1.zip\INSTALL.LOG;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdMonitor2.zip\chris@admonitor[3].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdMonitor2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop1.zip\searchnow.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdMonitor3.zip\chris@admonitor[1].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdMonitor3.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop2.zip\newsbarend.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop3.zip\mp3search_02.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop3.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom.zip\[email protected][2].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy2.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BonziBuddy2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop4.zip\main_01.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop4.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom1.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop5.zip\bottomright.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop5.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop6.zip\bottomleft.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop6.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom2.zip\chris@advertising[3].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop7.zip\aybgwarn.htm;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop7.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop8.zip\aybwarn.htm;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop8.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom3.zip\chrisa@advertising[2].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom3.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop9.zip\seperateline.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop9.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop10.zip\topright.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop10.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom4.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom4.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop11.zip\topleft.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop11.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop12.zip\Online Casino.ico;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop12.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom5.zip\chrisa@advertising[3].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom5.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop13.zip\Online Casino.exe;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop13.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop14.zip\seperateline3.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop14.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom6.zip\[email protected][5].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom6.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop15.zip\seperateline1.gif;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop15.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop16.zip\qdienrerth.dll;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop16.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom7.zip\[email protected][4].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom7.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload4.zip\comload.dll;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload4.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop17.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop17.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom8.zip\chrisa@advertising[5].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom8.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop18.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop18.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop19.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop19.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom9.zip\chrisa@advertising[4].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom9.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop20.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop20.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop21.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop21.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom10.zip\[email protected][3].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom10.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop22.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Clop22.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom11.zip\[email protected][3].txt;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom11.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload1.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload2.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:56 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom12.zip\[email protected][2].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom12.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload3.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload3.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SexTracker58.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SexTracker58.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom13.zip\chrisa@advertising[1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom13.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload5.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload5.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload6.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload6.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom14.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom14.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload7.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload7.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload8.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload8.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom15.zip\[email protected][2].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom15.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload9.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload9.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload10.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Comload10.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom16.zip\chris@advertising[1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Advertisingcom16.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction.zip\[email protected][2].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Adviva.zip\chrisa@adviva[2].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Adviva.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction1.zip\[email protected][3].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\EngageInc.zip\chrisa@engage[1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\EngageInc.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AlexaRelated.zip\RELATED.HTM;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AlexaRelated.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction2.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Enliven.zip\[email protected][2].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Enliven.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AllCyberSearch.zip\sp.dll;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AllCyberSearch.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction3.zip\[email protected][4].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction3.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Enliven1.zip\[email protected][3].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Enliven1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc.zip\chrisa@atdmt[6].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction4.zip\[email protected][3].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction4.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Enliven2.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Enliven2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc1.zip\chrisa@atdmt[2].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction5.zip\[email protected][2].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction5.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Enliven3.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Enliven3.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc2.zip\chrisa@atdmt[7].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction6.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction6.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FastClick.zip\chris@fastclick[1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FastClick.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc3.zip\chrisa@atdmt[5].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc3.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction7.zip\[email protected][5].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction7.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Gator.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Gator.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc4.zip\chrisa@atdmt[4].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc4.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction8.zip\[email protected][2].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction8.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Gator1.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Gator1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc5.zip\chrisa@atdmt[1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AvenueAInc5.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction9.zip\[email protected][4].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction9.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast.zip\chrisa@bfast[1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction10.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction10.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:57 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast1.zip\chrisa@bfast[3].txt;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast1.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction11.zip\[email protected][3].txt;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction11.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast2.zip\chrisa@bfast[4].txt;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast2.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction12.zip\[email protected][1].txt;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommissionJunction12.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast3.zip\chrisa@bfast[2].txt;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BFast3.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ConducentTimeSink.zip\sbRecovery.reg;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ConducentTimeSink.zip\sbRecovery.ini;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DoubleClick5.zip\chrisa@doubleclick[2].txt;password protected, has not been processed;6/22/2005 5:16:58 PM
C:\Documents and Settings\All Users\Application Data

[therock247uk]

1. Make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://www.xtra.co.n...1916458,00.html

2. Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.

3. While in safemode open Hijackthis and click scan. Then tick and fix the following in Hijackthis with all windows closed except Hijackthis.

O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program Files\DNS\Catcher.dll
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000093.exe

4. Delete the folders. (if present)

C:\Program Files\DNS\

5. Delete the files. (if present)

C:\Program Files\Common Files\mc-58-12-0000093.exe

6. Reboot and post a new Hijackthis log here in a reply.

Also how is the PC running still getting popups things trying to install etc?

[cale42]

Everything looks good so far.. haven't had things popping up or trying to install yet. Only adverse effect currently is still being stuck in Windows Classic mode only.. and the computer is a little slow but I think that is due to ewido, AVG, kaspersky, and kerio all simulataneoulsy running, which I can trim down once all is fixed. New HJT log is below

Logfile of HijackThis v1.99.1
Scan saved at 6:36:04 PM, on 6/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRAM FILES\WINAMP\winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Outlook Express\MSIMN.EXE
C:\Documents and Settings\ChrisA\Desktop\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\default\prefs.js)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\PROGRAM FILES\WINAMP\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes12031.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes12031.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et1_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt1_x.cab
O16 - DPF: Yahoo! Spades - http://download.game...nts/y/st2_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.co...ic/SimCityX.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

[therock247uk]

The slowness will probably be just because you have lots of programs running which you can trim down once we have you fully clean and your PC runnning fine.

1. Upload C:\Windows\explorer.exe to http://virusscan.jotti.org/ post the results this is just for me to make sure its clean

2. Download a copy of luna.msstyles here:
http://users.pandora...patchy/luna.zip
Unzip it and MOVE the luna.msstyles which is present in that folder you unzipped to next folder: C:\WINDOWS\Resources\Themes\Luna
Don't move it to anywhere else than that folder!
When moved it there, rightclick on your desktop > properties ... and look if Windows XPstyle is now present again. Choose apply and OK.
If not, reboot first, and try again to select Windows XPstyle

3. Post a new Hijackthis log here in a reply for me to make sure you are still clean.

[cale42]

Everything is looking good... I can't even begin to thank you enough.. I've always been able to beat spyware on my own.. but you guys are amazing. Results from explorer.exe scan are clean, and posted below.. followed by latest HJT log.

Service load:
0% 100%
File: EXPLORER.EXE
Status:
OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 b1155f89c01d7bce428dfb3bab102482
Packers detected:
-
Scanner results
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
VBA32
Found nothing


Logfile of HijackThis v1.99.1
Scan saved at 7:16:39 PM, on 6/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRAM FILES\WINAMP\winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Outlook Express\MSIMN.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\ChrisA\Desktop\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\default\prefs.js)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\PROGRAM FILES\WINAMP\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes12031.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes12031.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et1_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt1_x.cab
O16 - DPF: Yahoo! Spades - http://download.game...nts/y/st2_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.co...ic/SimCityX.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

[therock247uk]

Your log is clean

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

To protect yourself further:

• IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.

I also suggest that you delete any files from "temp", "tmp" folders. In Internet Explorer, click on "Tools" => "Internet Options" => "Delete Files" and select the box that says "Delete All Offline Content" and click on "OK" twice. Also, empty the recycle bin by right clicking on it and selecting "Empty Recycle Bin". These steps should be done on a regular basis.

Credit to PGPhantom for canned speech.

[cale42]

Thanks again for all your help. I always thought I did a pretty good job protecting myself.. but I've learned a lot from this experience, will be much more dilligent now.

cale

[therock247uk]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.