Okay. I got through all that. My logs are posted below. Some comments:
1. We never used PandaScan
2. SmitRem, while running, displayed several times messages like "could not access", "could not remove", etc. I did not choose the "admin" login when I rebooted in safe mode. Is that a problem?
3. There was no C:/Program Files/AutoUpdate present when I tried to remove it
4. I've tried to remove that DELL driver many times to no avail. I gave up months ago.
5. You're making me delete PartyPoker? But, but, but...grrr. Fine.
6.
Thanks again for your help!halolo
Logfile of HijackThis v1.99.1
Scan saved at 4:56:33 PM, on 7/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SlimServer\server\slim.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Real\Update_OB\realevent.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\Program Files\TM1184\ControlUtility\ControlUtility.exe
C:\Program Files\Exif Launcher\QuickDCF.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Hijack This\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.comcast.netR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r5.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *r5.attbi.com;<local>
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dll
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - C:\Program Files\CoreStreet\SpoofStick\SpoofStick.dll
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [sr1exe] "C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [SprintPort] "C:\Program Files\Sprint\PCS Connection Manager\SprintPort\SprintPortA.exe"
O4 - HKLM\..\Run: [ServiceConfig] "C:\Program Files\Comcast\MigCfg\programs\ispbeg.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: D-Link REG Utility.lnk = ?
O4 - Global Startup: Dell Control Utility.lnk = ?
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: Yahoo! Backgammon -
http://download.game...nts/y/at0_x.cabO16 - DPF: Yahoo! Blackjack -
http://download.game...nts/y/jt0_x.cabO16 - DPF: Yahoo! Chat -
http://us.chat1.yimg...t/c381/chat.cabO16 - DPF: Yahoo! Checkers -
http://download.game...nts/y/kt3_x.cabO16 - DPF: Yahoo! Chess -
http://download.game...nts/y/ct2_x.cabO16 - DPF: Yahoo! Chinese Checkers -
http://download.game...ts/y/cct0_x.cabO16 - DPF: Yahoo! Dots -
http://download.game...ts/y/dtt1_x.cabO16 - DPF: Yahoo! Euchre -
http://download.game...nts/y/et1_x.cabO16 - DPF: Yahoo! Fleet -
http://download.game...s/y/fltt2_x.cabO16 - DPF: Yahoo! Hearts -
http://download.game...nts/y/ht0_x.cabO16 - DPF: Yahoo! Literati -
http://download.game...nts/y/tt0_x.cabO16 - DPF: Yahoo! NFL GameChannel StatTracker -
http://aud3.sports.s...lgcst1010_x.cabO16 - DPF: Yahoo! Poker -
http://download.game...nts/y/pt0_x.cabO16 - DPF: Yahoo! Pyramids -
http://download.game...ts/y/pyt1_x.cabO16 - DPF: Yahoo! Reversi -
http://download.game...nts/y/rt0_x.cabO16 - DPF: Yahoo! Spades -
http://download.game...nts/y/st2_x.cabO16 - DPF: {009F6293-999F-4963-9CC1-9712DE4EF2EF} (WebCamX Control) -
http://66.92.129.100/WebCamX.cabO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell....iler/SysPro.CABO16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
http://www.pcpitstop...p/PCPitStop.CABO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft....738&clcid=0x409O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) -
http://www.pcpitstop...cpConnCheck.cabO16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) -
http://us.chat1.yimg...v45/yacscom.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) -
http://www.pestscan....r/axscanner.cabO16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} (CScanner Object) -
http://www.pestscan....er/ppctlcab.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai...all/xscan53.cabO16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} -
http://toolbar.googl...gleActivate.cabO16 - DPF: {9107A82A-248A-49E5-A7D2-4E12EAAD4DC2} (WebCamX Control) -
http://192.168.0.199/WebCamX.cabO16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) -
http://www.pcpitstop.com/mhLbl.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
http://zone.msn.com/...ro.cab33902.cabO16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) -
http://www.jeld-wen....sses/CFJava.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
http://zone.msn.com/...aploader_v6.cabO16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) -
http://chat.yahoo.com/cab/yvwrctl.cabO16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) -
http://fdl.msn.com/z...s/heartbeat.cabO16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) -
http://cdn.digitalci...illama/ampx.cabO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\SYSTEM32\r_server.exe" /service (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SlimServer (slimsvc) - Unknown owner - C:\Program Files\SlimServer\server\slim.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -service (file missing)
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 4:50:52 PM, 7/10/2005
+ Report-Checksum: FACF71A6
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Dsi -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{BC3BBF86-E4EC-4412-9676-8355468B3B05} -> Spyware.Maxspeed : Cleaned with backup
HKLM\SOFTWARE\PerfectNav -> Spyware.KeenValue : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Sexlist : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.97:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.112:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.115:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.117:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.118:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.121:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.123:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.158:C:\Documents and Settings\Hal\Application Data\Mozilla\Firefox\Profiles\jobamp60.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.12:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.167:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Findwhat : Cleaned with backup
:mozilla.233:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.234:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.240:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.241:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.271:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.272:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.273:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.274:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.316:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.319:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.384:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.385:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.386:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.387:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.388:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.389:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.390:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.431:C:\Documents and Settings\Monica\Application Data\Mozilla\Firefox\Profiles\nc8gaflo.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Monica\Application Data\Mozilla\Profiles\default\w86xx9jd.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Monica\Application Data\Mozilla\Profiles\default\w86xx9jd.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Monica\Application Data\Mozilla\Profiles\default\w86xx9jd.slt\cookies.txt -> Spyware.Cookie.Specificpop : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Monica\Application Data\Mozilla\Profiles\default\w86xx9jd.slt\cookies.txt -> Spyware.Cookie.Specificpop : Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\r_server.exe -> Not-A-Virus.RiskWare.RemoteAdmin.RAdmin.21 : Cleaned with backup
::Report End
Pre-run Files Present
~~~ Program Files ~~~
~~~ Shortcuts ~~~
PSGuard.lnk
~~~ system32 ~~~
oleadm.dll
wp.bmp
ole32vbs.exe
msole32.exe
intmon.exe
hhk.dll
logfiles
~~~ Windows directory ~~~
sites.ini
~~~ Drive root ~~~
Post-run Files Present
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ system32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Wininet.dll ~~~
Not Infected!