[brown2808]

I have recently been infected with the 180 search assistant and possibly some other junk. I think I may have gotten rid of most of it. I followed all the steps in the sticky post, and deleted some .exe and .dll files that I know shouldn't be there. Could someone please tell me if this log is clean.

Logfile of HijackThis v1.99.1
Scan saved at 12:21:32 PM, on 7/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.exe
c:\windows\system32\jhkvsr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ziplace.exe
C:\WINDOWS\system32\vidctrl\vidctrl.exe
C:\WINDOWS\system\rffbjjnrft.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\PromptCast\PromptCast.exe
C:\Program Files\Cas\Client\casclient.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\My Documents\David\hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/PhotoWorks-eLife
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINDOWS\tct101.dll (file missing)
O2 - BHO: COMMUNICATOR - {4E7BD74F-2B8D-469E-8DBC-A42EB79CB428} - C:\WINDOWS\system32\communicator.dll
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll (file missing)
O3 - Toolbar: COMMUNICATOR - {4E7BD74F-2B8D-469E-8DBC-A42EB79CB428} - C:\WINDOWS\system32\communicator.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitemkw32.exe
O4 - HKLM\..\Run: [adkz] C:\WINDOWS\adkz.exe
O4 - HKLM\..\Run: [ufhsov3s] C:\WINDOWS\system32\ufhsov3s.exe
O4 - HKLM\..\Run: [23nO3sT] ziplace.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [stb] C:\WINDOWS\system32\stb.exe
O4 - HKLM\..\Run: [nsbuqet] c:\windows\system32\jhkvsr.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PromptCast] C:\Program Files\PromptCast\PromptCast.exe
O4 - HKCU\..\Run: [J04ERif5g] wtscedit.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip....tgameloader.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} (AsyncDownloader Class) - http://survey.otxres...m/Preloader.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip....pGameLoader.dll
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip....bGameLoader.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.../ST/ActiveX.ocx
O16 - DPF: {5F3B3060-09E0-44C6-86F7-BC7B02B57BEE} - http://downloads.sho...inc1001_sp2.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia...ll/pcs_0002.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupd...ll/aun_0011.exe
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toon...5.22/ttinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Advertisements]

Hello

Sorry for the delayed response, it has been very busy lately.

If you still require help please post a new Hijack log in this
thread and I will help you. If your problem has been fixed please
respond and let us know.

Thanks

[loophole]

Hello

Sorry for the delayed response, it has been very busy lately.

If you still require help please post a new Hijack log in this
thread and I will help you. If your problem has been fixed please
respond and let us know.

Thanks

[brown2808]

I beleive I have gotten rid of the 180 search assistant now, but I have also had lots of pop ups and "Aurora" problems.

I ran all the fixes again and here is the hijack this and ewido logs.

Logfile of HijackThis v1.99.1
Scan saved at 4:11:24 AM, on 7/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\PromptCast\PromptCast.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Owner\My Documents\David\hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/PhotoWorks-eLife
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINDOWS\tct101.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll (file missing)
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitemkw32.exe
O4 - HKLM\..\Run: [adkz] C:\WINDOWS\adkz.exe
O4 - HKLM\..\Run: [ufhsov3s] C:\WINDOWS\system32\ufhsov3s.exe
O4 - HKLM\..\Run: [uaotga] c:\windows\system32\sugtohg.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PromptCast] C:\Program Files\PromptCast\PromptCast.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip....tgameloader.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} (AsyncDownloader Class) - http://survey.otxres...m/Preloader.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip....pGameLoader.dll
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip....bGameLoader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toon...5.22/ttinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe






---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 3:33:16 AM, 7/10/2005
+ Report-Checksum: A795ED07

+ Scan result:

HKLM\SOFTWARE\AutoLoader -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\AutoLoader\2w4k1YOVXYLW -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\AutoLoader\2w4y1YOVXYLW -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{04D2569C-ED83-79FB-0E43-F43DFA258774} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{06559367-A395-44B2-D6A0-0631D6323797} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{07FF232E-41D0-38A2-6073-6847AD3E6453} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0B2910B5-8AE6-8676-E13B-4CEC5E6A75F1} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0FBFA147-FFB4-19A8-49F8-D1A17B80E32D} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1674BCBE-46DE-7BAB-FBFA-CA15D9FEB632} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{18BDB348-E8B0-D5A4-55F2-74FD4CB49A69} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1DE20533-9118-BF9A-A6C6-F8E881A5FD4B} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1F5650BA-2C95-0E8C-5C3F-D482646BF979} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{21F8F0E0-D881-0FBC-CD1D-D1F30C3905B4} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{22C0D6EC-0DEF-83C0-2433-5AE91234F546} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2AC8EC43-EAE7-F7BD-2B63-7DE1FF58C69F} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2BFAB072-A3F3-0A97-6990-3673392B7DFC} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2D99FD34-F395-DFB0-0852-36D4976F6E3D} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{30E36B0A-CA1D-18E7-7FD2-9BA91D4D1710} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{41B07E2C-E9E2-8FB3-E92D-F43E8F8F3DBB} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{43372D0D-6EAD-977A-99EE-8DFB043153ED} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{44CE9131-E13C-D36A-083A-FAFF61E866CA} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{452C15DF-936D-C8CB-B825-97DD4A210ABD} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{47B70B6F-A6B0-230A-43C3-9F9B5C710209} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{47DA2122-90A1-597C-94D7-20963F392761} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{4AD64CAF-CC40-779E-C47E-E23705C41C75} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{4F8E9FA5-37E2-683E-E18D-19AC6697532D} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{4FFB405E-2D99-7374-B6D3-F0CD9DC8744E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{50B9D537-5DB0-52B1-FF6F-ED6C70DA477E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{57CEBAAD-4565-C660-5FAF-624E13DBE3B7} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5BCC3EE7-9153-E89F-6D4E-9B02B02B4E2E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5C2B2D9C-60FC-5F4C-5894-68EB7DFA3935} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5DA6CA48-7D98-BC0B-40EF-22AC6558668A} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5F4B11A7-C0A8-0B95-8741-481C8B0029E3} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{69A88C5E-04E5-741D-6CA2-9CB5374EB263} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6D012127-ABB2-BF82-D02A-24CBBD599720} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{735DDAC7-F8F1-47DD-D87A-6AF0100B6A48} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{765369C1-D4E0-D6A4-69B4-6261D4E1319A} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{7868EC16-8C67-1DBD-6D5A-EBB325881BD9} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{7904D3DD-22E5-C0C1-0648-E66A3897E380} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{81AE8953-3335-A1BB-5174-F82625372B4E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{826D0369-102B-4A44-F27B-D9DCC50A8EE6} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{841CB982-C366-4290-3F00-95A1A5F3C340} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{854F3880-4AA1-AF49-995D-6630908AFE8A} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{85E6B001-B482-61AE-78C6-6EAE60D74D00} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{865E2CEC-DCDC-CF30-C932-8A491F233655} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8669ABB2-7410-3460-F449-E119DCA24CC4} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{88289CAD-8761-B286-1697-48C2E3A53747} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{905BD5E4-261C-4EFD-5456-CD124D7B9D18} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{913EAD11-DA6B-5C8F-D264-E3D4FC8BA5DD} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{952B27F0-D129-A966-5DF7-9E2D52C7E338} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{9913F006-5621-D9B4-E3CB-064477E8D278} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{9B9D4A7D-1232-E364-432D-B58ECFAE5AF4} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{9E2092B1-77DB-2A6A-A476-8BAA6CC65237} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A167704A-0F01-8543-16A8-ECF3EBA5DC01} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A318BFD4-C3A4-E970-DD27-26C4F5F2AD25} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A678B034-1492-1AC1-FF9B-636BC85F5643} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A6A537E1-A69B-6C58-00AC-B6C4E8539037} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A7737E2C-9C15-D4BE-4A5B-C15B7E8C41E9} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A94D3AA0-A235-876E-2DCD-617E08BD8301} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{AF197E67-53B8-6C01-4733-3E7C25BA3A3B} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{AF6BCC5C-38B1-5871-226C-AC6482380057} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B1300934-5207-3933-066D-455DDE935ADD} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B33C5B98-F4B9-B550-C81A-4EE9720874BF} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B38F516E-48F2-CDBB-7D76-E0CFBCDBEE45} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B5AB638F-D76C-415B-A8F2-F3CEAC502212} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{BE5DCDBC-54D3-95EA-B258-2D53BD817431} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C174CC42-7291-0DCA-CE42-7DB1C655AADD} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C6984483-D454-B316-4040-575B9FB13D11} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{CAEA3DE4-DAC7-8DF9-1A53-651E63E86CDF} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{CAF35453-A9AB-61D6-E032-1F6CE85168F3} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{CC6A9DFF-521F-7DD3-E624-B30C0B9FF83A} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D4451521-F203-568E-2657-C5AD1F0B1F77} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D605EAFF-2C3A-4619-43C1-4FFB062F68DE} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D6C7DB36-C0AC-C91F-B408-61A55E5AB6C5} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D75B9D6B-FB2A-EE40-24DA-791D27C77147} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D775F18B-70E6-FBB1-C13D-52CE71E899B3} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D847DBFE-4EE2-AF6C-D202-0D9795B9D820} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DA826568-8230-C8BC-199C-3E738A0E5A48} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DBC8BCC3-8C2E-707C-3D8D-72B88F17460E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DE064CF5-809E-A243-CC14-F5427E5967A1} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{E36A99D7-088F-A5E8-1BA4-87116D938D49} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{E404F826-ABE4-D856-61BA-BCBD539933F8} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EC6CC6A4-2DE4-7D97-7906-9D8567369627} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EDE4719B-AC04-9EE1-7AEA-7712560B2832} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EF4CB83E-BEF0-2DE3-F01E-55D0127FF3EA} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F065E398-2ACB-9034-8B2A-28A827FF521F} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F2255AF4-092C-0BF6-52CF-8484B194FCC4} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F22C21C3-2FA8-F0A7-72B3-7927ADEFC66E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F2903213-C2D0-B852-F56D-8B10D6C8C121} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F6802757-10AB-DBC8-719A-C48394D31082} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F704A16D-BA8A-0DD4-CB9E-F0FA4A957D8D} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FA6A8ADC-5ACF-A739-A8BF-5E4D7B5991C1} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FD4A74BF-5712-24E2-4DA7-6711D4FD291B} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FDEDD1BB-EE5D-1AF2-C50B-11681C5E2A93} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FE0CF482-D7A9-BD18-0056-CF55E4EDD446} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ISTbarISTbar -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DisplayUtility -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDH -> Spyware.DealHelper : Cleaned with backup
HKLM\SOFTWARE\motoin -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy -> Spyware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy\Update -> Spyware.SearchRelevancy : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\dsktb -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\dsktb\DesktopToolbar -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\LQ -> Dialer.Generic : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{016235BE-59D4-4CEB-ADD5-E2378282A1D9} -> Spyware.AproposMedia : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\Mvu -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\_hsrb -> Spyware.Hotsearchbar : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\_hsrb\kkws -> Spyware.Hotsearchbar : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\_hsrb\ppops -> Spyware.Hotsearchbar : Cleaned with backup
HKU\S-1-5-21-1850668124-3114375751-940012086-1003\Software\_hsrb\ssites -> Spyware.Hotsearchbar : Cleaned with backup
C:\WINDOWS\amyzz.txt:bmbmd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\amyzz.txt:rbenp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\aucfg.ini:czxwb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\aucfg.ini:hewan -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\aucfg.ini:lxwcw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\aucfg.ini:nxcnv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\aucfg.ini:opwfi -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\aucfg.ini:pwzsj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\aucfg.ini:qtmhw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\aucfg.ini:tulyu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\aucfg.ini:vqygr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\aucfg.ini:wongq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\aucfg.ini:zdbpa -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\aucfg.ini:zyrzg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:bahwu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:bgiaf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:erdrgl -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:gblkg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:grusd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:jdylv -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:mgowt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:ngvwg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:thuel -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:tqyfg -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:uufxt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\AuHCcup1.ini:woqhf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\buieb.txt:fhktzf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\buieb.txt:knpih -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\buieb.txt:lrlvf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\buieb.txt:wfgpf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\buieb.txt:wkwje -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\CareBear.ini:bwcee -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CareBear.ini:cbpry -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CareBear.ini:hlzba -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CareBear.ini:ifxsuc -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\CareBear.ini:pmaoi -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\CareBear.ini:rcwuu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CareBear.ini:sqxqw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\CareBear.ini:ufbws -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CareBear.ini:ugsroa -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\CareBear.ini:uoabd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CareBear.ini:vhamv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\CareBear.ini:yciooj -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\ccyzo.txt:vqujkv -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\cdplayer.ini:boeju -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\cdplayer.ini:hgbqst -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\cdplayer.ini:hiofd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\cdplayer.ini:lizrt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\cdplayer.ini:mrgnn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\cdplayer.ini:vljcl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\cdplayer.ini:xbwvh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\cdplayer.ini:xiope -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\control.ini:fmqge -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\control.ini:ifkqm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\control.ini:ihits -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\control.ini:khgjr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\control.ini:pnpgtc -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\control.ini:utdgk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\desktop.ini:dolob -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\desktop.ini:eowdy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\desktop.ini:hfsoug -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\desktop.ini:tpwmz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\desktop.ini:twhpu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\desktop.ini:vsqzj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\desktop.ini:xjklj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\desktop.ini:xtfyw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Disney.ini:cptzj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Disney.ini:ekvhf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Disney.ini:mmxgb -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\Disney.ini:tjteo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Disney.ini:zjzqp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\drvi\fqnieunkwb.dll -> Spyware.SmartPops : Cleaned with backup
C:\WINDOWS\drvi\fqnieunkwb.exe -> Spyware.SmartPops : Cleaned with backup
C:\WINDOWS\epxmc.txt:cwffz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\epxmc.txt:pflun -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\fuuap.txt:feewf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\fuuap.txt:kakhx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\fuuap.txt:ticbt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\GetServer.ini:femcr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\GetServer.ini:nrbnv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\GetServer.ini:ogwvf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\GetServer.ini:pfgpt -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\GetServer.ini:pidgq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\GetServer.ini:uybvoe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\GetServer.ini:vvtvl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\GetServer.ini:zbtcz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\GetServer.ini:zfqwj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\gopri.txt:gfmrk -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\gopri.txt:xyudsg -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\hbmxm.txt:axhbu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\hbmxm.txt:cxeys -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\hbmxm.txt:dxcol -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\hbmxm.txt:gcodb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\hbmxm.txt:habrh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\hbmxm.txt:kaerw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\hbmxm.txt:soinj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\hnigc.txt:zdqpr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\intuprof.ini:clnhim -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\intuprof.ini:jssxf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\intuprof.ini:juwnu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\intuprof.ini:mmmpb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\intuprof.ini:ofzit -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\intuprof.ini:pdugp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\intuprof.ini:qxtruj -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\intuprof.ini:rpdda -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\intuprof.ini:stbjh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\intuprof.ini:tkcsf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\intuprof.ini:uamyr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\iPlayer.INI:htgkk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\iPlayer.INI:nkhgf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\iPlayer.INI:sxjta -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ka.ini:elrnx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ka.ini:esoqf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ka.ini:ioshn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ka.ini:nvzke -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ka.ini:vqmmw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\kevcz.txt:kzvxm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\kevcz.txt:lplya -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\kevcz.txt:punbu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\kevcz.txt:rpshz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\kevcz.txt:stvvg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\kevcz.txt:tkazm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\kevcz.txt:yvxdn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Kyor.ini:cvnnu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Kyor.ini:mizux -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Kyor.ini:mnmez -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Kyor.ini:qoejq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Kyor.ini:spmwu -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\Kyor.ini:tpqxu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Kyor.ini:vrwsj -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\Kyor.ini:vsgqq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Kyor.ini:wsozn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Kyor.ini:wtxjy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Kyor.ini:xoufv -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\Kyor.ini:xyyfg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ldlnm.txt:tnldq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ldlnm.txt:yqgzk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ldlnm.txt:yqokf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ltzof.txt:avqtq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ltzof.txt:dxadc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ltzof.txt:kqjtr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ltzof.txt:mosdn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ltzof.txt:pvqif -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ltzof.txt:seafi -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ltzof.txt:vmiwn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mbrvj.txt:fpyyq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\mbrvj.txt:mqvrh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mbrvj.txt:nkkji -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mbrvj.txt:somqs -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mbrvj.txt:xpxwv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\mbrvj.txt:yamzdm -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\ModemLog_Lucent Win Modem.txt:benxb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ModemLog_Lucent Win Modem.txt:cskwb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ModemLog_Lucent Win Modem.txt:jrzvb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ModemLog_Lucent Win Modem.txt:khquv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ModemLog_Lucent Win Modem.txt:knnmv -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\ModemLog_Lucent Win Modem.txt:oixsqz -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\ModemLog_Lucent Win Modem.txt:thwhs -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msdfmap.ini:bjfdbv -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\msdfmap.ini:cguarj -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\msdfmap.ini:iunpt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msdfmap.ini:jfoat -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msdfmap.ini:kbyps -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msdfmap.ini:pkbez -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msdfmap.ini:pzypgr -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\msdfmap.ini:siiro -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msdfmap.ini:srtfh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msdfmap.ini:swjzs -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msdfmap.ini:vxqbm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msdfmap.ini:zdwes -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:chryy -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:fmlnz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:iixyj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:ivpna -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:lxfyc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:mhpmv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:nnwmg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:oydoq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:ppdoj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:tetua -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:vdqlx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:wlhgl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msnavpklog.txt:zidmh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\nkjpz.txt:amgvg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nkjpz.txt:nunpx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\nkjpz.txt:sspam -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nkjpz.txt:tjcyy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nkjpz.txt:ufrbh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nkjpz.txt:vqutu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\nkjpz.txt:ymnue -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:cleqv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:exwfw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:ffdyj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:gcxia -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:kiylg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:klosx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:oqrxk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:owwcy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:qgwxv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBC.INI:mrcar -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBC.INI:pkjpg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBC.INI:varcui -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBC.INI:xjrrs -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:ccaya -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:ceexn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:iwceu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:nicqv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:njyfqf -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:sysap -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:tjudm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:uouzq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:upsod -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:xqeov -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\oecln.txt:jdtlb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:dkrhp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:frbew -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:hcpjo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:iyihk -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:jvabw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:lbqve -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:lrwas -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:ojbyv -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:pruun -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:wtkyt -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\orun32.ini:gnzol -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\orun32.ini:hluciy -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\orun32.ini:vlwjk -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\pavsig.txt:qswoo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\pcfriend.INI:ammic -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\pcfriend.INI:apxpx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\pcfriend.INI:dacsu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\pcfriend.INI:ihplh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\pcfriend.INI:qwvyi -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\pcfriend.INI:rnjhe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\pcfriend.INI:uiqhz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\pcfriend.INI:yycax -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PolkaDot.ini:dptib -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PolkaDot.ini:nqolx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\PolkaDot.ini:omcsd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PolkaDot.ini:otryr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\PolkaDot.ini:qdvhp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\PolkaDot.ini:sffnf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\PolkaDot.ini:yckgf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\PolkaDot.ini:yeldf -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\qesuj.txt:umkwf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\qetwc.txt:bmean -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\qetwc.txt:lwcxg -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\qetwc.txt:nfpqs -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\qetwc.txt:qkjsr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\qetwc.txt:tkfmk -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\QUICKEN.INI:bnslz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\QUICKEN.INI:gnrpm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\QUICKEN.INI:licdj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\QUICKEN.INI:murfv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\QUICKEN.INI:nwzgc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\QUICKEN.INI:oeozx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\QUICKEN.INI:rzygb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\QUICKEN.INI:xhmoh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:bbbrx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:budgq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:gwksu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:itger -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:plcik -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:qxwnnc -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:tmvtv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:zlfgs -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:znwpy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setuplog.txt:cfqrw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setuplog.txt:ojloh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setuplog.txt:qrhmx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\setuplog.txt:rgior -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setuplog.txt:rokao -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setuplog.txt:rtmeg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setuplog.txt:syjts -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setuplog.txt:zubyf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\sghqn.txt:ctcnf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\sghqn.txt:dnbei -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\sghqn.txt:gjnum -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SIERRA.INI:actrg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SIERRA.INI:cfjcr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SIERRA.INI:cftkl -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SIERRA.INI:lmxxc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SIERRA.INI:odkrh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SIERRA.INI:qgllj -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\SIERRA.INI:sdgpx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SIERRA.INI:wdvxa -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\SIERRA.INI:xuyvf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\smscfg.ini:blhez -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\smscfg.ini:csrcw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\smscfg.ini:eooar -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\smscfg.ini:fggbz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\smscfg.ini:hbxjg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\smscfg.ini:qrten -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\smscfg.ini:wumtk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\smscfg.ini:xqltv -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\snzoh.txt:cixir -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\snzoh.txt:cztzn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\snzoh.txt:dtniv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\snzoh.txt:frtqm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\snzoh.txt:woqbp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\snzoh.txt:ydwpd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\snzoh.txt:zlpgd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ssk.exe -> TrojanDropper.SurfSide.a : Cleaned with backup
C:\WINDOWS\suxii.txt:aqtig -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\suxii.txt:llfcj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\suxii.txt:mnkpw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\suxii.txt:qlwji -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\suxii.txt:rvfwj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\suxii.txt:xfczb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\suxii.txt:zcnpb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system.ini:dnlqx -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\system.ini:otfxq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system.ini:vshxc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system.ini:xxffj -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\system32\DrPMon.dll_tobedeleted -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\f3PSSavr.scr -> Spyware.MyWebSearch : Cleaned with backup
C:\WINDOWS\system32\ibihej.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\nlwugq.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\vndkah.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\vtjbnr.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\wbhbfgx.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\ybxjqie.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\ycbjrv.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\yciwyj.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\zaxsuz.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\szcby.txt:bnzov -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\szcby.txt:ciiff -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\szcby.txt:ijioa -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\szcby.txt:mmxfu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\szcby.txt:oohkk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\szcby.txt:wrpza -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tempf.txt:bldzw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tempf.txt:ddaox -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tempf.txt:fobay -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tempf.txt:gkyen -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tempf.txt:hjtos -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tempf.txt:oanya -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tempf.txt:pwhaj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tempf.txt:tljms -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tempf.txt:ueinbd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tempf.txt:waxay -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tempf.txt:wbrpsv -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\tempf.txt:xnfht -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\tmpcpyis.bat:dwowz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tmpcpyis.bat:jpnfw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tmpcpyis.bat:krblg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tmpcpyis.bat:kwhqe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tmpcpyis.bat -> Backdoor.AcidShiver : Cleaned with backup
C:\WINDOWS\tmupdate.ini:edevqv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tmupdate.ini:lkqrd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tmupdate.ini:ryjyo -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\tmupdate.ini:socyz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tmupdate.ini:swwpi -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\tmupdate.ini:uoull -> Trojan.Feat : Cleaned with backup
C:\WINDOWS\tmupdate.ini:zzcjo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TSC.ini:igjzq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TSC.ini:lmosm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\TSC.ini:mmoks -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TSC.ini:mzdvy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TSC.ini:npnyn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TSC.ini:rdjwk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TSC.ini:rgves -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\TSC.ini:uipne -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TSC.ini:wruqo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\TSC.ini:xohsx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TSC.ini:ynlqz -> TrojanD

[loophole]

Hello brown2808

I see you have some malware issues . Let's get you fixed up

You may wish to print out a copy of these instructions to follow while you complete this procedure

Download LQfix Here http://users.pandora...atchy/LQfix.zip
save it to your desktop, please do not use yet

Download and install CleanUp! Here
but do not run it yet.
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.
R3 - Default URLSearchHook is missing
R3 - Default URLSearchHook is missing
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINDOWS\tct101.dll (file missing)
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll (file missing)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitemkw32.exe
O4 - HKLM\..\Run: [adkz] C:\WINDOWS\adkz.exe
O4 - HKLM\..\Run: [ufhsov3s] C:\WINDOWS\system32\ufhsov3s.exe
O4 - HKLM\..\Run: [uaotga] c:\windows\system32\sugtohg.exe r
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} (AsyncDownloader Class) - http://survey.otxres...m/Preloader.dll

Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Using windows explorer( right click start, left click explore)
Search for and delete these files and folders (if they are present)
C:\WINDOWS\adkz.exe
C:\WINDOWS\cfgmgr52.dll
C:\WINDOWS\system32\richup.exe
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\system32\ufhsov3s.exe
c:\windows\system32\sugtohg.exe

Run the LQfix from your desktop

please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal

Run Cleanup

Now rescan with Ewido and save the log

Reboot and post a new Hijack log and the log from Ewido

Thanks

[brown2808]

Logfile of HijackThis v1.99.1
Scan saved at 10:28:50 AM, on 7/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\PromptCast\PromptCast.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Owner\My Documents\David\hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/PhotoWorks-eLife
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PromptCast] C:\Program Files\PromptCast\PromptCast.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip....tgameloader.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip....pGameLoader.dll
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip....bGameLoader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toon...5.22/ttinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe




---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:24:39 AM, 7/10/2005
+ Report-Checksum: 42F2B9A6

+ Scan result:

C:\Documents and Settings\Owner\.jpi_cache\file\1.0\Counter.class-762d722b-4533f52c.class -> TrojanDownloader.Small.wv : Cleaned with backup
C:\Documents and Settings\Owner\.jpi_cache\file\1.0\SecurityClassLoader.class-6fd9f626-4a6f58e7.class -> TrojanDownloader.Small.wv : Cleaned with backup
C:\Documents and Settings\Owner\My Documents\David\hijack this\backups\backup-20050703-173604-394.dll -> Spyware.180Solutions : Cleaned with backup
C:\Program Files\SearchRelevant\SearchRelevant.dll -> Spyware.Relevance : Cleaned with backup


::Report End

[loophole]

That log looks good. Are you still having any problems?

[brown2808]

As far as I can tell right now, everything looks good.
No pop ups.

Thanks a lot!!!

[loophole]

Glad to hear it

your system is clean

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

Detect and Remove Programs:

• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

Prevention Programs:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
• IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.

Other necessary Programs:

• AntiVirus Program<= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kapersky, this is a must have.
• Firewall<= A firewall is definatley a must have. Two good free versions are Sygate and ZoneLabs.
• More Secure Browser<= Internet Explorer is not the most secure and best browser. There are safer and better alternatives available. I recommend Firefox, however Opera and SlimBrowsers are good as well.

And also see TonyKlein's good advice
So how did I get infected in the first place? and Spyware Aid's spyware article: Spyware, Adware, Malware: What it is, how it got on my computer, how to get rid of it, and how to prevent it.

[loophole]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.