[blink182rocks]

My friend has been having trouble with her computer, she has tons of viruses and has the nasty Aurora pop-ups. She's not very skilled at using computers and getting rid of viruses and the like, so I am helping her, but I need to know what to do to fix her problems. I'm not able to use her computer at the moment, I'm writing this from mine, but I did get a hijackthis log from her computer. I'm really sorry for not going through with the things you need to do before posting a hijackthis log, but I have a short amount of time to fix her computer and I think its needs a lot of help. Thank you very much!
Here is her logfile:

Logfile of HijackThis v1.99.1
Scan saved at 11:32:56 PM, on 7/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\SymantecAntiVirus\DefWatch.exe
C:\Program Files\Symantec_Client_Security\SymantecAntiVirus\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\cidaemon.exe
c:\windows\system32\awlulpk.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\owjeno.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Roxio\Easy CD Creator5\DirectCD\DirectCD.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\PROGRA~1\INTERN~3\inetmgr.exe
C:\Program Files\Viewpoint\ViewpointManager\ViewMgr.exe
C:\PROGRA~1\INTERN~3\inetsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\txxptvtx\cAQAF4BN.exe
C:\Program Files\CommonFiles\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\txxptvtx\NB4FAQAc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\jre1.5.0_01\bin\jucheck.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\COMMON~1\mmwi\mmwim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\RDSHOST.exe
C:\WINDOWS\system32\sessmgr.exe
C:\PROGRA~1\COMMON~1\mmwi\mmwia.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hijack This (its not a virus emily)\HijackThis.exe

R1 - HKCU\Software\Microsoft\InternetExplorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\InternetExplorer\Main,Search Bar =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\InternetExplorer\Main,Search Page =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\InternetExplorer\Main,Default_Page_URL =http://www.comcast.net
R1 - HKLM\Software\Microsoft\InternetExplorer\Main,Search Bar =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\InternetExplorer\Main,Search Page =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\InternetExplorer\Main,Start Page =http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R0 - HKLM\Software\Microsoft\InternetExplorer\Search,SearchAssistant =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\InternetExplorer\Search,CustomizeSearch =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\InternetExplorer\SearchURL,(Default) =websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\InternetExplorer\Main,Window Title = Microsoft InternetExplorer provided by Comcast
R3 - URLSearchHook: (no name) -{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\ProgramFiles\SurfSideKick 3\SskBho.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exeC:\WINDOWS\Nail.exe
O2 - BHO: Band Class -{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -C:\WINDOWS\systb.dll
O2 - BHO: Browser -{046D6EA4-15E3-4b27-8010-45BD78A9219E} -C:\PROGRA~1\INTERN~3\inetkw.dll
O2 - BHO: (no name) -{53707962-6F74-2D53-2644-206D7942484F} -C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper -{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiles\google\googletoolbar2.dll
O2 - BHO: NLS UrlCatcher Class -{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -C:\WINDOWS\System32\nvms.dll
O2 - BHO: ADP UrlCatcher Class -{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: (no name) -{C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: (no name) -{40D41A8B-D79B-43d7-99A7-9EE0F344C385} - (no file)
O3 - Toolbar: &Google -{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiles\google\googletoolbar2.dll
O3 - Toolbar: (no name) -{2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\ProgramFiles\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\ProgramFiles\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vptray]C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [inetmgr]C:\PROGRA~1\INTERN~3\inetmgr.exe
O4 - HKLM\..\Run: [ViewMgr] C:\ProgramFiles\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe"C:\ProgramFiles\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [QuickTime Task] "C:\ProgramFiles\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [iassvcs]C:\WINDOWS\System32\iassvcs.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\ProgramFiles\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [mmwi]C:\PROGRA~1\COMMON~1\mmwi\mmwim.exe
O8 - Extra context menu item: &Google Search -res://C:\ProgramFiles\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links -res://C:\ProgramFiles\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Backward Links -res://c:\programfiles\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page- res://C:\ProgramFiles\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Cached Snapshot of Page- res://c:\programfiles\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to MicrosoftExcel -res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages -res://C:\ProgramFiles\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Similar Pages -res://c:\programfiles\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -res://C:\ProgramFiles\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM -{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\ProgramFiles\AIM\aim.exe
O9 - Extra button: (no name) -{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\ProgramFiles\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\ProgramFiles\Messenger\msmsgs.exe
O9 - Extra button: Help -{5694232F-A7FD-4B09-8B6C-BA134F5534AF} -http://www.comcast.net/memberservices/ (file missing)(HKCU)
O9 - Extra button: Support -{80FE5F1F-D1B9-4436-8868-22A9F8D4286F} -http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: ComcastHSI -{E3634F71-14F5-4F76-9BA5-142E7BAD53DF} -http://www.comcast.net (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\InternetExplorer\Plugins\NPDocBox.dll
O14 - IERESET.INF:START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} -file://c:\counter.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}(WUWebControl Class) -http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120211602421
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1}(ActiveScan Installer Class) -http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000}(YahooYMailTo Class) -http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592}(ZoneIntro Class) -http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF}(Live365Player Class) -http://www.live365.com/players/play365.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB}(iTunesDetector Class) -http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822}(HeartbeatCtl Class) -http://fdl.msn.com/zone/datafiles/heartbeat.cab
O20 - Winlogon Notify: igfxcui -C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon -C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation -C:\Program Files\Symantec_Client_Security\SymantecAntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - AppleComputer, Inc. - C:\ProgramFiles\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - LexmarkInternational, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec AntiVirus Client (NortonAntiVirus Server) - Symantec Corporation - C:\ProgramFiles\Symantec_Client_Security\SymantecAntiVirus\Rtvscan.exe
O23 - Service: System Startup Service (SvcProc) -Unknown owner - C:\WINDOWS\svcproc.exe



Thanks again!

[Advertisements]

Hey blink182rocks


Download and install CleanUp! Here
but do not run it yet.
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

Now run cleanup

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
R1 - HKCU\Software\Microsoft\InternetExplorer\Main,Search Bar =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\InternetExplorer\Main,Search Page =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\InternetExplorer\Main,Search Bar =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\InternetExplorer\Main,Search Page =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\InternetExplorer\Main,Start Page =http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R0 - HKLM\Software\Microsoft\InternetExplorer\Search,SearchAssistant =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\InternetExplorer\Search,CustomizeSearch =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\InternetExplorer\SearchURL,(Default) =websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: Band Class -{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -C:\WINDOWS\systb.dll
O2 - BHO: Browser -{046D6EA4-15E3-4b27-8010-45BD78A9219E} -C:\PROGRA~1\INTERN~3\inetkw.dll

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan. (we will still have more work to do

[loophole]

Hey blink182rocks


Download and install CleanUp! Here
but do not run it yet.
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

Now run cleanup

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
R1 - HKCU\Software\Microsoft\InternetExplorer\Main,Search Bar =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\InternetExplorer\Main,Search Page =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\InternetExplorer\Main,Search Bar =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\InternetExplorer\Main,Search Page =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\InternetExplorer\Main,Start Page =http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R0 - HKLM\Software\Microsoft\InternetExplorer\Search,SearchAssistant =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\InternetExplorer\Search,CustomizeSearch =http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\InternetExplorer\SearchURL,(Default) =websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: Band Class -{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -C:\WINDOWS\systb.dll
O2 - BHO: Browser -{046D6EA4-15E3-4b27-8010-45BD78A9219E} -C:\PROGRA~1\INTERN~3\inetkw.dll

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan. (we will still have more work to do

[blink182rocks]

Hijackthis Logfile:

Logfile of HijackThis v1.99.1
Scan saved at 6:36:28 PM, on 7/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\txxptvtx\cAQAF4BN.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\txxptvtx\NB4FAQAc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\febsdg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Hijack This (its not a virus emily)\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll (file missing)
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: (no name) - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [inetmgr] C:\PROGRA~1\INTERN~3\inetmgr.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [iassvcs] C:\WINDOWS\System32\iassvcs.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [mmwi] C:\PROGRA~1\COMMON~1\mmwi\mmwim.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Help - {5694232F-A7FD-4B09-8B6C-BA134F5534AF} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {80FE5F1F-D1B9-4436-8868-22A9F8D4286F} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {E3634F71-14F5-4F76-9BA5-142E7BAD53DF} - http://www.comcast.net (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120211602421
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab32846.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe



Ewido Scan Report:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 6:23:19 PM, 7/8/2005
+ Report-Checksum: 8CC6CE71

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{046D6EA4-15E3-4b27-8010-45BD78A9219E} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5A5F9339-F6A5-4464-95E3-A00BCA6206E3} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{746CEE9E-7A1D-417f-9A35-804A0217268B} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{87067F04-DE4C-4688-BC3C-4FCF39D609E7} -> Spyware.WebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8940E505-72C6-44DE-BE85-1D746780EFBF} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Browser -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Browser\CLSID -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Browser\CurVer -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Handler -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Handler\CLSID -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Handler\CurVer -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Helper -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Helper\CLSID -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\INetKW.Helper\CurVer -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{3A951AF0-53F8-4803-A565-0E1DEE4B11F5} -> Spyware.SEP : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{3C7624D1-C414-4D1B-8FE9-52FA0558FB62} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{49DB48FF-02B5-4645-B676-94A4DF1AA026} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{6CDC3337-01F7-4A79-A4AF-0B19303CC0BE} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{6E0ED53C-9908-49ED-B055-7CB31B162577} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{830D3AED-2FA9-454F-B266-D931862BBF34} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8C53BD8E-B12D-4C8F-AD0E-C9DDC39D1273} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E1357} -> Spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E5678} -> Spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{96B3B1B9-A510-4603-BD66-2BB2C9F21542} -> Spyware.AdRotator : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{9BCDD51B-4A7B-446C-8452-D32D38004582} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{A986F4DB-792E-4571-8974-0BB6E024766F} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{AA4939C3-DECA-4A48-A454-97CD587C0EF5} -> Spyware.ISTBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{AF286CEA-635D-40C5-A891-B40A0F520539} -> Spyware.SEP : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B288F21C-A144-4CA2-9B70-8AFA1FAE4B06} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{BCCAB53D-0895-40C3-A942-A03538CE227A} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{C0F88E9E-DCEB-4655-968A-AE508A677C39} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED11357} -> Spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED15678} -> Spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{C8FFABC6-B706-4278-9399-169DF9FBF37E} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{D7EAC2D8-2D52-4010-A4AD-DFDF60C1706C} -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{E318D698-27B3-44D5-8998-C35EAFB9C034} -> Spyware.MidAddle : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{EEE4A2E5-9F56-432F-A6ED-F6F625B551E0} -> Dialer.Generic : Cleaned with backup
HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Spyware.WebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res\WToolsB.ResProtocol -> Spyware.WebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\SWLAD1.SWLAD -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\SWLAD1.SWLAD\Clsid -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\SWRT01.RT -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\SWRT01.RT\Clsid -> Spyware.SecondThought : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{127ACE33-7EA8-45F0-8B55-EFE8B8068BEF} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516B2C3} -> Spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516C2E3} -> Spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{5E594162-60A9-487D-84B8-DBDD716CB862} -> Spyware.VirtualBouncer : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{E0D3B292-A0B0-4640-975C-2F882E039F52} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Dsi -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Internet Keyword -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Internet Keyword\BabeIE -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Internet Keyword\User -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{046D6EA4-15E3-4b27-8010-45BD78A9219E} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Keyword -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NaviSearch -> Spyware.NaviSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PGate -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\midADdle -> Spyware.MidAddle : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Services\WinIK -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+, -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,- -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-. -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./01 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./012 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$% -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%& -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&' -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'( -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'() -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()* -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+, -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,- -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-. -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./01 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./012 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$% -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%& -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&' -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'( -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'() -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()* -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+, -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,- -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-. -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./01 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./012 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$% -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%& -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&' -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'( -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'() -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()* -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+, -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,- -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-. -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./01 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./012 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$% -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%& -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&' -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'( -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'() -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()* -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+, -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,- -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-. -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./01 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./012 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$% -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%& -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&' -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'( -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'() -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()* -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+, -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,- -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-. -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./01 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./012 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123 -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$ -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$% -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%&'()*+,-./0123$%& -> Spyware.CommonName : Error during cleaning
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\Internet Keyword -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\Internet Keyword\User -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\intexp -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\intexp\Config -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\intexp\MyFileSystem2 -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{046D6EA4-15E3-4B27-8010-45BD78A9219E} -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\WinTools -> Spyware.WebSearch : Cleaned with backup
HKU\S-1-5-21-2853502033-2158994649-899838973-1007\Software\WinTools\URLSearchHooks -> Spyware.WebSearch : Cleaned with backup
C:\counter.cab/counter.exe -> TrojanDropper.Small.ls : Error during cleaning
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
C:\Program Files\Common Files\mmwi\mmwil.exe -> TrojanDownloader.TSUpdate.j : Cleaned with backup
C:\Program Files\Common Files\mmwi\mmwim.exe -> TrojanDownloader.TSUpdate.k : Cleaned with backup
C:\Program Files\Common Files\mmwi\mmwip.exe -> Spyware.Xupiter : Cleaned with backup
C:\Program Files\Internet Keyword\ikw.exe -> Spyware.CommonName.j : Cleaned with backup
C:\Program Files\Internet Keyword\inetkw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\Internet Keyword\inetmgr.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\Internet Keyword\inetsvc.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\txxptvtx\bogFHgBL.dll -> Spyware.BabeIE : Cleaned with backup
C:\Program Files\txxptvtx\bogFHgBL.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\txxptvtx\cAQAF4BN.dll -> Spyware.CommonName : Error during cleaning
C:\Program Files\txxptvtx\cAQAF4BN.exe -> Spyware.CommonName : Error during cleaning
C:\Program Files\txxptvtx\cnml.exe -> Spyware.CommonName : Error during cleaning
C:\Program Files\txxptvtx\eQQDIcRN.dll -> Spyware.BabeIE : Cleaned with backup
C:\Program Files\txxptvtx\eQQDIcRN.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\txxptvtx\LBgHFgob.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\txxptvtx\NB4FAQAc.exe -> Spyware.CommonName : Error during cleaning
C:\Program Files\txxptvtx\NRcIDQQe.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\txxptvtx\WINIK.SYS -> Trojan.Rootkit.Agent.q : Cleaned with backup
C:\Program Files\vorour\prtptw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vorour\prtptw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vorour\wtptrp.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupppptur\pwvtttowxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupppptur\pwvtttowxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupppptur\wxwotttvwp.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupqstqwp\osuqquowxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupqstqwp\osuqquowxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupqstqwp\wxwouqquso.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuprvxpwv\rxtxwuowxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuprvxpwv\rxtxwuowxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuprvxpwv\wxwouwxtxr.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuptprptv\wvtutvowxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuptprptv\wvtutvowxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuptprptv\wxwovtutvw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupusvqpx\wxwowqruox.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupusvqpx\xourqwowxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupusvqpx\xourqwowxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupvwoxov\rtsoxwowxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupvwoxov\rtsoxwowxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupvwoxov\wxwowxostr.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupxptpwv\rxtvtxowxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupxptpwv\rxtvtxowxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxupxptpwv\wxwoxtvtxr.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqosxrsr\pvusqopwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqosxrsr\pvusqopwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqosxrsr\wxwpoqsuvp.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqpwrrsr\pvupxopwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqpwrrsr\pvupxopwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqpwrrsr\wxwpoxpuvp.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqrpvvsx\svwwtppwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqrpvvsx\svwwtppwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqrpvvsx\wxwpptwwvs.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqstqorp\tpouqqpwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqstqorp\tpouqqpwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqstqorp\wxwpqquopt.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqtwuoxr\usorxqpwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqtwuoxr\usorxqpwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqtwuoxr\wxwpqxrosu.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqvpxxrv\wuxxtrpwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqvpxxrv\wuxxtrpwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqvpxxrv\wxwprtxxuw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqwtsqwp\ospvqspwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqwtsqwp\ospvqspwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqwtsqwp\wxwpsqvpso.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqxwwuqt\qprsxspwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqxwwuqt\qprsxspwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuqxwwuqt\wxwpsxsrpq.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurpqrrpr\utuputpwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurpqrrpr\utuputpwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurpqrrpr\wxwptuputu.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurqtvrsr\pvuwqupwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurqtvrsr\pvuwqupwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurqtvrsr\wxwpuqwuvp.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurrxpsxx\wxwpuxtvsx.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurrxpsxx\xsvtxupwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurrxpsxx\xsvtxupwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurtqtxov\rtxquvpwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurtqtxov\rtxquvpwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurtqtxov\wxwpvuqxtr.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuruuoorp\tpoorwpwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuruuoorp\tpoorwpwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuruuoorp\wxwpwroopt.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurvxspqt\quovxwpwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurvxspqt\quovxwpwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurvxspqt\wxwpwxvouq.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurxqvxrv\wuxruxpwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurxqvxrv\wuxruxpwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxurxqvxrv\wxwpxurxuw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusouptxr\uxvoroqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusouptxr\uxvoroqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusouptxr\wxwqorovxu.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuspxtvpx\wxwqoxvwtx.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuspxtvpx\xtwvxoqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuspxtvpx\xtwvxoqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusrqxtrp\tuvsupqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusrqxtrp\tuvsupqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusrqxtrp\wxwqpusvut.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxussurrvt\vwuprqqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxussurrvt\vwuprqqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxussurrvt\wxwqqrpuwv.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxustxvour\prtwxqqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxustxvour\prtwxqqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxustxvour\wxwqqxwtrp.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusvrpptv\wvtturqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusvrpptv\wvtturqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusvrpptv\wxwqruttvw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuswuswvt\vrsqrsqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuswuswvt\vrsqrsqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuswuswvt\wxwqsrqsrv.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusxxwvwp\oxrxxsqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusxxwvwp\oxrxxsqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxusxxwvwp\wxwqsxxrxo.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutprqvsx\svruutqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutprqvsx\svruutqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutprqvsx\wxwqtuurvs.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutquvpqt\qutrruqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutquvpqt\qutrruqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutquvpqt\wxwqurrtuq.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutsoowvt\vrsoovqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutsoowvt\vrsoovqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutsoowvt\wxwqvoosrv.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuttrswpr\uosvuvqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuttrswpr\uosvuvqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuttrswpr\wxwqvuvsou.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutuuwvsx\svrsrwqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutuuwvsx\svrsrwqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutuuwvsx\wxwqwrsrvs.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutwoqwpr\uospoxqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutwoqwpr\uospoxqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutwoqwpr\wxwqxopsou.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutxrusxx\wxwqxuwqsx.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutxrusxx\xsqwuxqwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxutxrusxx\xsqwuxqwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuovosrv\wpqtrorwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuovosrv\wpqtrorwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuovosrv\wxwrortqpw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuqosrpr\utpqoprwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuqosrpr\utpqoprwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuqosrpr\wxwrpoqptu.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuurrwtxr\uxqxuprwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuurrwtxr\uxqxuprwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuurrwtxr\wxwrpuxqxu.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuusvqptv\wvourqrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuusvqptv\wvourqrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuusvqptv\wxwrqruovw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuuotxov\rtxqorrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuuotxov\rtxqorrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuuotxov\wxwrroqxtr.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuvrxxrv\wuxxurrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuvrxxrv\wuxxurrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuvrxxrv\wxwrruxxuw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuwvrxux\swxursrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuwvrxux\swxursrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuuwvrxux\wxwrsruxws.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvoovwpr\uoxrotrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvoovwpr\uoxrotrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvoovwpr\wxwrtorxou.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvpspxrv\wuxovtrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvpspxrv\wuxovtrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvpspxrv\wxwrtvoxuw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvqvuour\prowrurwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvqvuour\prowrurwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvqvuour\wxwrurworp.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvspoqpx\wxwrvotpox.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvspoqpx\xoptovrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvspoqpx\xoptovrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvtsssux\srqqvvrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvtsssux\srqqvvrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvtsssux\wxwrvvqqrs.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvuvwsxx\wxwrwrxqsx.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvuvwsxx\xsqxrwrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvuvwsxx\xsqxrwrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvwpqorp\tpouoxrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvwpqorp\tpouoxrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvwpqorp\wxwrxouopt.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvxsuvpx\wxwrxvrrtx.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvxsuvpx\xtrrvxrwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuvxsuvpx\xtrrvxrwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwowovsx\svrososwxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwowovsx\svrososwxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwowovsx\wxwsosorvs.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwqpssxx\wxwspovqsx.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwqpssxx\xsqvopswxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwqpssxx\xsqvopswxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwrswpwv\rxosvpswxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwrswpwv\rxosvpswxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwrswpwv\wxwspvsoxr.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwswqorp\tpopsqswxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwswqorp\tpopsqswxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwswqorp\wxwsqspopt.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwuptxux\swxvorswxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwuptxux\swxvorswxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwuptxux\wxwsrovxws.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwvsxvpx\wxwsrvswtx.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwvsxvpx\xtwsvrswxw.dll -> Spyware.CommonName : Cleaned with backup
C:\Program Files\vxuwvsxvpx\xtwsvrswxw.exe -> Spyware.CommonName : Cleaned with backup
C:\Program Fil

[loophole]

Hello blink182rocks

Sorry for the late reply. Im out of town and not having alot of free time.
Any way that looks better.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll (file missing)
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [inetmgr] C:\PROGRA~1\INTERN~3\inetmgr.exe
O4 - HKCU\..\Run: [iassvcs] C:\WINDOWS\System32\iassvcs.exe
O4 - HKCU\..\Run: [mmwi] C:\PROGRA~1\COMMON~1\mmwi\mmwim.exe
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab

Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Using windows explorer( right click start, left click explore)
Search for and delete these files and folders

C:\PROGRA~1\INTERN~3\inetmgr.exe
C:\WINDOWS\System32\iassvcs.exe
C:\PROGRAM FILES\COMMON FILES\mmwi<<<<,folder

Reboot and post a new Hijack log

[blink182rocks]

Here is the hijackthis logfile:

Logfile of HijackThis v1.99.1
Scan saved at 11:37:01 AM, on 7/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
c:\windows\system32\zuhrwnb.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\txxptvtx\cAQAF4BN.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\txxptvtx\NB4FAQAc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Hijack This (its not a virus emily)\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O3 - Toolbar: (no name) - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Help - {5694232F-A7FD-4B09-8B6C-BA134F5534AF} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {80FE5F1F-D1B9-4436-8868-22A9F8D4286F} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {E3634F71-14F5-4F76-9BA5-142E7BAD53DF} - http://www.comcast.net (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120211602421
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab32846.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe


Thanks again!

[loophole]

Hello blink182rocks

Well we seemed to have backed up a bit.We will have to run the fix for Nail or Aurora again. Not sure if you got infected again or what happenned. Well that doesnt matter now anyway. Let's go after it.

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please update Ewido

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Please copy the text from within the code box below and paste it into a blank notepad window.
Save it as fix.reg and in the save as type box choose all files.

Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK]

Please reboot into safe mode Safe mode(continually tap the F8 key while your system is starting, select Safe Mode from the menu).


Please uninstall the following (click start||control panel||add/remove programs) If present
WildTangent
Viewpoint Manager
SurfSideKick 3

Using windows explorer( right click start, left click explore)
Search for and delete folders
C:\Program Files\SurfSideKick 3
C:\Program Files\WildTangent
C:\Program Files\Viewpoint\Viewpoint Manager


please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Now run cleanup

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O3 - Toolbar: (no name) - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe

Now click fix checked

Reboot and post a new Hijack log and the Ewido log

Thanks

[blink182rocks]

While I was trying to dowload nailfix, the link to the page said that there was "No such file The file you requested does not exist in our database." Is there another place I can download Nailfix? Thanks!

[loophole]

http://www.noidea.us...050515010747824

try that

[loophole]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.