Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

aurora - i've had enough! [CLOSED]


  • This topic is locked This topic is locked

#1
karoline

karoline

    New Member

  • Member
  • Pip
  • 6 posts
i've had pop-up ads from aurora for the past few weeks and i'm finally completely frustrated. here is my hijackthis log.. any help would be wonderful. thank you.



Logfile of HijackThis v1.99.1
Scan saved at 8:26:18 PM, on 6/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\wscntfy.exe
c:\windows\system32\gzskouo.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\windows\temp\GN.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM95\aim.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Kodak\Picture Easy Software\Program\PezDownload.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUMENTS AND SETTINGS\KAROLINE SWIONTEK\DESKTOP\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://decapolis.com.../ultimatebb.cgi
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Forward Communications 8.0
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {B60439C9-AD20-0D5E-3F89-53E1F5297505} - C:\WINDOWS\System32\hotovdvf.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Search-O-Matic - {4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} - C:\WINDOWS\DOWNLO~1\MyGeek.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ZingSpooler] C:\Program Files\Common Files\Zing\ZingSpooler.exe
O4 - HKLM\..\Run: [rb32 ml710e] "C:\Program Files\RapidBlaster\rb32.exe"
O4 - HKLM\..\Run: [<H] c:\WINDOWS\System32\<HEAD>
O4 - HKLM\..\Run: [ <TITLE>Error</TI] c:\WINDOWS\System32\ <TITLE>Error</TITLE>
O4 - HKLM\..\Run: [</H] c:\WINDOWS\System32\</HTML>
O4 - HKLM\..\Run: [<B] c:\WINDOWS\System32\<BODY>
O4 - HKLM\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKLM\..\Run: [] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKLM\..\Run: [<A HREF="http://www.gandi.net...net/">GANDI</A> then par] c:\WINDOWS\System32\<A HREF="http://www.gandi.net...net/">GANDI</A> then parked.
O4 - HKLM\..\Run: [</B] c:\WINDOWS\System32\</BODY>
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [GN] C:\windows\temp\GN.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [kaxcffv] c:\windows\system32\gzskouo.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [<H] c:\WINDOWS\System32\<HEAD>
O4 - HKCU\..\Run: [ <TITLE>Error</TI] c:\WINDOWS\System32\ <TITLE>Error</TITLE>
O4 - HKCU\..\Run: [</H] c:\WINDOWS\System32\</HTML>
O4 - HKCU\..\Run: [<B] c:\WINDOWS\System32\<BODY>
O4 - HKCU\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKCU\..\Run: [] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKCU\..\Run: [<A HREF="http://www.gandi.net...net/">GANDI</A> then par] c:\WINDOWS\System32\<A HREF="http://www.gandi.net...net/">GANDI</A> then parked.
O4 - HKCU\..\Run: [</B] c:\WINDOWS\System32\</BODY>
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Kodak Picture Easy 3.1 Batch Transfer.lnk = C:\Program Files\Kodak\Picture Easy Software\Program\PezDownload.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: TFTP1576
O4 - Global Startup: TFTP2640
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.wea...Transporter.cab?
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...ol_v1-0-3-9.cab
O16 - DPF: {4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} (Search-O-Matic) - http://www.search-o-....com/mygeek.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150...tzip/RdxIE2.cab
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} (ZingBatchAXDwnl Class) - http://www.imagestat...ion=4,3,2,20802
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.14...tiveXImgCtl.CAB
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg...ol_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1D7DBE5-DB50-4C36-BC1B-2B198525B0CF}: NameServer = 66.187.160.7 66.187.160.8
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Edited by karoline, 30 June 2005 - 06:34 PM.

  • 0

Advertisements


#2
Kristy

Kristy

    Visiting Consultant

  • Member
  • PipPipPipPip
  • 1,099 posts
Hello karoline, welcome to Geeks to Go! I'm Kristy and I will be helping you.

You may wish to print out a copy of these instructions to follow while you complete this procedure.

First lets take care of RapidBlaster. Download RapidBlaster Killer 1.61 , to your desktop, and run it.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible

Next, please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml


Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then, go to Start > Run > and type in:

services.msc

Click OK.

In the services window find System Startup Service.
Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK. Exit the Services utility.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

Are you familiar with Forward Communications? If so, do not place a check next to the items in green. Also, do you know what this site is http://decapolis.com.../ultimatebb.cgi? If you do, don’t place a check next to the items in orange.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://decapolis.com.../ultimatebb.cgi

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Forward Communications 8.0
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {B60439C9-AD20-0D5E-3F89-53E1F5297505} - C:\WINDOWS\System32\hotovdvf.dll
O3 - Toolbar: Search-O-Matic - {4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} - C:\WINDOWS\DOWNLO~1\MyGeek.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [rb32 ml710e] "C:\Program Files\RapidBlaster\rb32.exe"
O4 - HKLM\..\Run: [<H] c:\WINDOWS\System32\<HEAD>
O4 - HKLM\..\Run: [ <TITLE>Error</TI] c:\WINDOWS\System32\ <TITLE>Error</TITLE>
O4 - HKLM\..\Run: [</H] c:\WINDOWS\System32\</HTML>
O4 - HKLM\..\Run: [<B] c:\WINDOWS\System32\<BODY>
O4 - HKLM\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKLM\..\Run: [] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKLM\..\Run: [<A HREF="http://www.gandi.net...net/">GANDI</A> then par] c:\WINDOWS\System32\<A HREF="http://www.gandi.net...net/">GANDI</A> then parked.
O4 - HKLM\..\Run: [</B] c:\WINDOWS\System32\</BODY>
O4 - HKLM\..\Run: [GN] C:\windows\temp\GN.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [kaxcffv] c:\windows\system32\gzskouo.exe r
O4 - HKCU\..\Run: [<H] c:\WINDOWS\System32\<HEAD>
O4 - HKCU\..\Run: [ <TITLE>Error</TI] c:\WINDOWS\System32\ <TITLE>Error</TITLE>
O4 - HKCU\..\Run: [</H] c:\WINDOWS\System32\</HTML>
O4 - HKCU\..\Run: [<B] c:\WINDOWS\System32\<BODY>
O4 - HKCU\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKCU\..\Run: [] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKCU\..\Run: [<A HREF="http://www.gandi.net...net/">GANDI</A> then par] c:\WINDOWS\System32\<A HREF="http://www.gandi.net...net/">GANDI</A> then parked.
O4 - HKCU\..\Run: [</B] c:\WINDOWS\System32\</BODY>
O4 - Global Startup: TFTP1576
O4 - Global Startup: TFTP2640
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.wea...Transporter.cab?
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} (Search-O-Matic) - http://www.search-o-....com/mygeek.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150...tzip/RdxIE2.cab
Forward Communications

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe


Close all open windows except for HijackThis and click Fix Checked.

Next in Hijack This click on the "Config" button in the lower right corner. In the next window click on the "Misc Tools" button at the top then click the "Delete an NT service" button. Copy and paste the following line in that box:

SvcProc

Click OK.

Go to Start > Run and type in cmd

Click OK

This will open a command shell. In the command window Copy and Paste the following commands one at a time exactly as the appear below and hit the Enter key after each one:

Paste this:

del C:\WINDOWS\svcproc.exe

Hit Enter.

Be sure you're able to view hidden files, and remove the following files/folders in bold (if found):

C:\WINDOWS\System32\hotovdvf.dll
C:\WINDOWS\DOWNLO~1\MyGeek.dll
C:\Program Files\RapidBlaster\rb32.exe
c:\WINDOWS\System32\<HEAD>
c:\WINDOWS\System32\ <TITLE>Error</TITLE>
c:\WINDOWS\System32\</HTML>
c:\WINDOWS\System32\<BODY>
c:\WINDOWS\System32\<A HREF="http://www.gandi.net...net/">GANDI</A> then parked.
c:\WINDOWS\System32\</BODY>
C:\windows\temp\GN.exe
C:\WINDOWS\farmmext.exe
c:\windows\system32\gzskouo.exe r
c:\WINDOWS\System32\<HEAD>
c:\WINDOWS\System32\ <TITLE>Error</TITLE>
c:\WINDOWS\System32\The site you have requested doesn't exist.
c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from


Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

~Kristy :tazz:

Edited by Rustymilo, 02 July 2005 - 03:01 PM.

  • 0

#3
karoline

karoline

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
hi kristy!

thanks for your help so far!

i've tried to download Nailfix, but the link does not seem to be working. is there another link i should try?

also, i downloaded rapidblaster killer 1.61 and ran it. however, no rapidblaster processes were detected. i'm assuming i still have rapidblaster running somewhere on my computer though?
  • 0

#4
Kristy

Kristy

    Visiting Consultant

  • Member
  • PipPipPipPip
  • 1,099 posts
Hello karoline,

Try this link http://dknoppix.com/...oad.cgi?Nailfix, and continue with all of the steps. After you post your new HijackThis log we will see if RapidBlaster is still on your computer and take care of anything else that is left. :tazz:

~Kristy

Edited by Rustymilo, 06 July 2005 - 05:05 PM.

  • 0

#5
karoline

karoline

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
kristy,

i restarted my pc in safe mode, however, once in the services window, i could not find "System Startup Services". i am concerned by this...
  • 0

#6
Kristy

Kristy

    Visiting Consultant

  • Member
  • PipPipPipPip
  • 1,099 posts
Hello karoline,

That's okay for now, continue with the parts that you can do and we will take care of the rest after. :tazz:

~Kristy
  • 0

#7
karoline

karoline

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
here is my new HijackThisLog:

Logfile of HijackThis v1.99.1
Scan saved at 5:21:42 PM, on 7/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AIM95\aim.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Kodak\Picture Easy Software\Program\PezDownload.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Karoline Swiontek\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://decapolis.com.../ultimatebb.cgi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Forward Communications 8.0
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ZingSpooler] C:\Program Files\Common Files\Zing\ZingSpooler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [yjkpqvt] c:\windows\system32\lbvcxg.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Kodak Picture Easy 3.1 Batch Transfer.lnk = C:\Program Files\Kodak\Picture Easy Software\Program\PezDownload.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: TFTP1576
O4 - Global Startup: TFTP2640
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...ol_v1-0-3-9.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150...tzip/RdxIE2.cab
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} (ZingBatchAXDwnl Class) - http://www.imagestat...ion=4,3,2,20802
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.14...tiveXImgCtl.CAB
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg...ol_v1-0-3-0.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#8
karoline

karoline

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
here is the log from the Ewido scan:

(thanks Kristy for your help so far :tazz: )

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 9:55:38 PM, 7/6/2005
+ Report-Checksum: 147DE139

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{00000000-C1EC-0345-6EC2-4D0300000000} -> Spyware.Transponder : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} -> Spyware.MyGeek : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{0F2A4ADC-DABF-4980-8DB4-19F67D7B1F95} -> Spyware.ClearSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{A93B84C6-5278-473A-8027-F6304A291A7A} -> Spyware.VX2 : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{F0F4C299-735E-4EAC-B2F9-F97324D5CC1D} -> Spyware.VX2 : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\ZServDll.ZServDllObj -> Spyware.BetterInternet : Cleaned with backup
HKLM\SOFTWARE\Classes\ZServDll.ZServDllObj\CLSID -> Spyware.BetterInternet : Cleaned with backup
HKLM\SOFTWARE\Classes\ZServDll.ZServDllObj\CurVer -> Spyware.BetterInternet : Cleaned with backup
HKLM\SOFTWARE\IncrediFind -> Spyware.KeenValue : Cleaned with backup
HKLM\SOFTWARE\IncrediFind\BHO -> Spyware.KeenValue : Cleaned with backup
HKLM\SOFTWARE\IncrediFind\BHO\HomePage -> Spyware.KeenValue : Cleaned with backup
HKLM\SOFTWARE\IncrediFind\BHO\RedirectURLS -> Spyware.KeenValue : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} -> Spyware.MyGeek : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\updater -> Spyware.KeenValue : Cleaned with backup
HKLM\SOFTWARE\updater\{8D15A72D-62E0-4733-B057-0A81B4FFEB3D} -> Spyware.KeenValue : Cleaned with backup
HKLM\SOFTWARE\WildMedia -> Spyware.MidAddle : Cleaned with backup
HKLM\SOFTWARE\WildMedia\LicenseStores -> Spyware.MidAddle : Cleaned with backup
HKU\S-1-5-21-3479383672-3924064129-568730901-1006\Software\intexp -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-3479383672-3924064129-568730901-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-C1EC-0345-6EC2-4D0300000000} -> Spyware.Transponder : Cleaned with backup
HKU\S-1-5-21-3479383672-3924064129-568730901-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0000607D-D204-42C7-8E46-216055BF9918} -> Spyware.TwainTech : Cleaned with backup
HKU\S-1-5-21-3479383672-3924064129-568730901-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-3479383672-3924064129-568730901-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> Spyware.WinFavorites : Cleaned with backup
HKU\S-1-5-21-3479383672-3924064129-568730901-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} -> Spyware.MyGeek : Cleaned with backup
HKU\S-1-5-21-3479383672-3924064129-568730901-1006\Software\ZServ -> Spyware.BetterInternet : Cleaned with backup
C:\cxtpls_loader.exe -> TrojanDownloader.Apropo.ab : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.80:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.81:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.87:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.97:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.104:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.110:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.111:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.241:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.242:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.243:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.244:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.245:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.246:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.247:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.248:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.249:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.250:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.251:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.252:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.253:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.254:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.256:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.257:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.258:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.259:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.260:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.261:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.262:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.263:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.264:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.265:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.266:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.267:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.268:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.269:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.270:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.271:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.272:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.273:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.274:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.275:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.276:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.277:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.278:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.279:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.280:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.281:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.282:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.283:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.284:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.285:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.286:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.287:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.301:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.302:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.303:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.304:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.305:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.306:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.329:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.330:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.341:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.342:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.343:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.348:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.350:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.351:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.352:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.373:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.374:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.375:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.378:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.379:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.380:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.381:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.382:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.386:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.387:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.391:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Addynamix : Cleaned with backup
:mozilla.398:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.399:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.402:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.403:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.404:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.405:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.406:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.407:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.408:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.409:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.410:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.411:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.412:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.438:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.439:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.440:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.441:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.453:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.454:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.463:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.466:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.467:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.468:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.469:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.475:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.476:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.477:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.478:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.527:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.528:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.529:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.530:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.549:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.551:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
:mozilla.552:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
:mozilla.571:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.581:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.582:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.633:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.634:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.636:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.660:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.661:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.665:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.711:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.728:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.732:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
:mozilla.733:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
:mozilla.809:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.821:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.822:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.823:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.835:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.841:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.842:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.843:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.844:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.853:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
:mozilla.854:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
:mozilla.855:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
:mozilla.856:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
:mozilla.857:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
:mozilla.866:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.872:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.873:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.875:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.876:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.884:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.936:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@adorigin[2].txt -> Spyware.Cookie.Adorigin : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@ads.adorigin[1].txt -> Spyware.Cookie.Adorigin : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@ads.euniverseads[1].txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@ads.hyperbanner[2].txt -> Spyware.Cookie.Hyperbanner : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@ads.pointroll[1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@ads.trafficvenue[1].txt -> Spyware.Cookie.Trafficvenue : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@ads.x10[1].txt -> Spyware.Cookie.X10 : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@perf.overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@specificpop[1].txt -> Spyware.Cookie.Specificpop : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@trafficvenue[1].txt -> Spyware.Cookie.Trafficvenue : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Belt.exe -> TrojanDownloader.Stubby.a : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@euniverseads[1].txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@servedby.advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@targetnet[2].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Cookies\karoline swiontek@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\DrTemp\wupdt.exe -> TrojanDownloader.Intexp.c : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\host.cab/host.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\host.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\ICD3.tmp\QDow.dll -> TrojanDownloader.QDown.d : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\ICD5.tmp\QDow.dll -> TrojanDownloader.QDown.d : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\ICD6.tmp\QDow.dll -> TrojanDownloader.QDown.d : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\ICD8.tmp\QDow.dll -> TrojanDownloader.QDown.d : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\OYU\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\PAC\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\randreco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Susp.cab/susp.exe -> TrojanDownloader.Stubby.a : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\susp.exe -> TrojanDownloader.Stubby.a : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI1F61.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI1F61.tmp\ZServ.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI2171.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI2171.tmp\ZServ.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI30F8.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI30F8.tmp\ZServ.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI47FE.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI47FE.tmp\ZServ.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\polall1t.exe -> TrojanDownloader.Agent.ae : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\preInsTT.exe -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\twaintec.cab/twaintec.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\twaintec.cab/preInsTT.exe -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\twaintec.cab/polall1t.exe -> TrojanDownloader.Agent.ae : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\twaintec.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI55AB.tmp\mxTarget.cab/mxTarget.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI55AB.tmp\mxTarget.cab/preInsMt.exe -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI55AB.tmp\mxTarget.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI55AB.tmp\preInsMt.exe -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI55E.tmp\wupdt.exe -> TrojanDownloader.Intexp.c : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5855.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5855.tmp\ZServ.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5925.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5925.tmp\ZServ.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI59E5.tmp\preInsTT.exe -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI59E5.tmp\twaintec.cab/twaintec.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI59E5.tmp\twaintec.cab/preInsTT.exe -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI59E5.tmp\twaintec.dll -> Spyware.BiSpy : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI6F18.tmp\wupdt.exe -> TrojanDownloader.Intexp.c : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI73F9.tmp\farmmext.cab/farmmext.exe -> Spyware.ConsCorr : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI73F9.tmp\farmmext.exe -> Spyware.ConsCorr : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI7F58.tmp\wupdt.exe -> TrojanDownloader.Intexp : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\zserv.cab/ZServ.dll -> Spyware.DlMax : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\ZServ.dll -> Spyware.DlMax : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temporary Internet Files\Content.IE5\WZIHGFI3\thnall1t[2].exe -> Adware.BetterInternet : Cleaned with backup
C:\Program Files\Common Files\updater\sui.exe -> TrojanDownloader.Keenal : Cleaned with backup
C:\Program Files\Common Files\updater\wupdater.exe -> TrojanDownloader.Keenval : Cleaned with backup
C:\Program Files\Lycos\IEagent\CSBIINST.DLL -> Spyware.ClearSearch : Cleaned with backup
C:\Program Files\Lycos\IEagent\CSIE.DLL -> Spyware.ClearSearch : Cleaned with backup
C:\Program Files\Lycos\IEagent\Loader.exe -> TrojanDownloader.Small.Go : Cleaned with backup
C:\Program Files\nCase\msbb.exe -> Spyware.180Solutions : Cleaned with backup
C:\Program Files\nCase\ncmyb.dll -> Spyware.180Solutions : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP565\A0041050.exe -> TrojanDownloader.Intexp.c : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP565\A0041051.dll -> Spyware.BiSpy : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP565\A0041066.dll -> Spyware.BiSpy : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP616\A0046412.exe -> TrojanDownloader.Agent.ae : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP616
  • 0

#9
Kristy

Kristy

    Visiting Consultant

  • Member
  • PipPipPipPip
  • 1,099 posts
Hello karoline,

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Next please run HijackThis, click Scan, and check:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D} - (no file)
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [yjkpqvt] c:\windows\system32\lbvcxg.exe r
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150...tzip/RdxIE2.cab


I see that these two are still there:
O4 - Global Startup: TFTP1576
O4 - Global Startup: TFTP2640

Did you not place a check by them because you know what they are? Or did they just not go away? If they just did not go away place a check by them.

Close all open windows except for HijackThis and click Fix Checked.

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).

Be sure you're able to view hidden files, and remove the following files/folders in bold (if found):

C:\WINDOWS\wupdt.exe
c:\windows\system32\lbvcxg.exe r


Empty your recycle bin.

Now run Ewido and save the log from the scan.

Reboot normally.

If you would please, rescan with HijackThis and post a fresh log in this same topic, along with the Ewido log and let us know how your system's working. ;)

~Kristy :tazz:
  • 0

#10
karoline

karoline

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
hi kristy,

i ran HijackThis, but could not find the following to check:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe

i've been trying to delete the two Global Startups, but i get an error message saying "Unable to delete. File may be in use. Use Task Manager to shutdown the program and run HijackThis." i could not find either of them in task manager, but they are still supposedly running on my computer.

i was able to view hidden files, but both C:\WINDOWS\wupdt.exe and
c:\windows\system32\lbvcxg.exe r were not found, so i think those have been taken care of.

i have a copy of HijackThis on my C:/ drive (i copied and pasted it there), but when i try to delete it from the desktop, i'm told i can't run the program any longer.. i'm sure i'm just doing something stupid..

____________

here is a fresh HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:04:09 AM, on 7/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM95\aim.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Kodak\Picture Easy Software\Program\PezDownload.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Karoline Swiontek\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://decapolis.com.../ultimatebb.cgi
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Forward Communications 8.0
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ZingSpooler] C:\Program Files\Common Files\Zing\ZingSpooler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Kodak Picture Easy 3.1 Batch Transfer.lnk = C:\Program Files\Kodak\Picture Easy Software\Program\PezDownload.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: TFTP1576
O4 - Global Startup: TFTP2640
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...ol_v1-0-3-9.cab
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} (ZingBatchAXDwnl Class) - http://www.imagestat...ion=4,3,2,20802
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.14...tiveXImgCtl.CAB
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg...ol_v1-0-3-0.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


_________________

here is the Ewido log:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:55:27 AM, 7/10/2005
+ Report-Checksum: 88E395B

+ Scan result:

:mozilla.26:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.185:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.192:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.194:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.208:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.209:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.210:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.211:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.212:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.213:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.214:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.221:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.253:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.254:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.256:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.257:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.258:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.272:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.273:C:\Documents and Settings\Karoline Swiontek\Application Data\Mozilla\Firefox\Profiles\4urpb3yp.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Cookies\karoline swiontek@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\host.cab/host.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\Susp.cab/susp.exe -> TrojanDownloader.Stubby.a : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI1F61.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI2171.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI30F8.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI47FE.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\twaintec.cab/twaintec.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\twaintec.cab/preInsTT.exe -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5262.tmp\twaintec.cab/polall1t.exe -> TrojanDownloader.Agent.ae : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI55AB.tmp\mxTarget.cab/mxTarget.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI55AB.tmp\mxTarget.cab/preInsMt.exe -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5855.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI5925.tmp\zserv.cab/ZServ.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI59E5.tmp\twaintec.cab/twaintec.dll -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI59E5.tmp\twaintec.cab/preInsTT.exe -> Spyware.BiSpy : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\THI73F9.tmp\farmmext.cab/farmmext.exe -> Spyware.ConsCorr : Error during cleaning
C:\Documents and Settings\Karoline Swiontek\Local Settings\Temp\zserv.cab/ZServ.dll -> Spyware.DlMax : Error during cleaning
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047387.exe -> TrojanDownloader.Apropo.ab : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047388.exe -> TrojanDownloader.Keenal : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047389.exe -> TrojanDownloader.Keenval : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047390.DLL -> Spyware.ClearSearch : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047391.DLL -> Spyware.ClearSearch : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047392.exe -> TrojanDownloader.Small.Go : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047393.exe -> Spyware.180Solutions : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047394.dll -> Spyware.180Solutions : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047395.exe -> TrojanDownloader.Keenval : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047396.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047397.exe -> Spyware.ConsCorr : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047398.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047399.exe -> TrojanSpy.Achum : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047400.exe -> TrojanDownloader.Agent.ae : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047401.exe -> Spyware.BiSpy : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047402.exe -> Spyware.BiSpy : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047403.exe -> TrojanDownloader.Small.ne : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047404.dll -> Spyware.ImiBar : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047405.exe -> Trojan.Imiserv.c : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047406.exe -> Spyware.Adtomi : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047407.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047408.exe -> Spyware.BookedSpace.b : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047409.dll -> Trojan.Golid.d : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047410.dll -> TrojanDownloader.Rameh.b : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047411.exe -> TrojanDropper.Small.ff : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047412.dll -> Trojan.Navid.c : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047413.exe -> TrojanDownloader.Agent.cp : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047414.exe -> TrojanDownloader.Small.Iq : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047415.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047416.dll -> Adware.SAHA : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047417.exe -> Spyware.WinFetcher.b : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP640\A0047418.exe -> Trojan.Imiserv.c : Cleaned with backup
C:\WINDOWS\SYSTEM32\c17b6s.dll/bi.dll -> Spyware.BiSpy : Error during cleaning
C:\WINDOWS\SYSTEM32\c17b6s.dll/biprep.exe -> Trojan.Bispy.B : Error during cleaning


::Report End


_________________

my computer is running better than it was a few weeks ago. Aurora is definitely gone. :tazz:

thanks for all of your help, kristy. let me know if there are other things which you recommend deleting / taking care of. ;)

-karoline
  • 0

#11
Kristy

Kristy

    Visiting Consultant

  • Member
  • PipPipPipPip
  • 1,099 posts
Hello karoline,

You may wish to print out a copy of these instructions to follow while you complete this procedure.

First, download and install CleanUp! but do not run it yet.
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).

Once in Safe Mode, Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
Click OK
Press the CleanUp! button to start the program.

After Cleanup! is finished:
  • Run Ewido
  • Click on scanner
  • Click Complete System Scan
  • Let the program scan the machine
While the scan is in progress you will be prompted to clean the first infected file it finds. Choose "clean", then put a check next to "Perform action on all infections" in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.

As long as you know that you don't need these, next please run HijackThis, click Scan, and check:

O4 - Global Startup: TFTP1576
O4 - Global Startup: TFTP2640


Close all open windows except for HijackThis and click Fix Checked.

If you would please, rescan with HijackThis and post a fresh log in this same topic, along with the Ewido log, and let us know how your system's working. ;)

~Kristy :tazz:
  • 0

#12
Kristy

Kristy

    Visiting Consultant

  • Member
  • PipPipPipPip
  • 1,099 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP