Sorry it took so long to get back to you! It wouldn't let me delete C:\WINDOWS\system32\dxcpcsvc.dll, saying that it was being used by another file. I'm still getting Aurora ABI pop-ups. Here's the HijackThis Log:
Logfile of HijackThis v1.99.1
Scan saved at 4:06:40 PM, on 7/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\windows\system32\oqaosj.exe
C:\Program Files\HijackThis\HijackThis.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [osxhzla] c:\windows\system32\oqaosj.exe r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoft.../as5/asinst.cabO20 - Winlogon Notify: Run - C:\WINDOWS\system32\dxcpcsvc.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
And here's the Ewido Scan:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 2:25:54 PM, 7/19/2005
+ Report-Checksum: A9C5E180
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\intexp -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\LQ -> Dialer.Generic : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> Spyware.BookedSpace : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10E42047-DEB9-4535-A118-B3F6EC39B807} -> Spyware.SideFind : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{86227D9C-0EFE-4F8A-AA55-30386A3F5686} -> Spyware.YourSiteBar : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.ISTBar : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup
HKU\S-1-5-21-156640315-4283021946-2165517387-1003\Software\Microsoft\Windows\CurrentVersion\Policies\AMeOpt -> Spyware.InternetOptimizer : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@centrport[2].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@goldenpalace[1].txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@qksrv[1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@questionmarket[2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@targetnet[1].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][1].txt -> Spyware.Cookie.Shopathomeselect : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][2].txt -> Spyware.Cookie.Sidefind : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@ysbweb[1].txt -> Spyware.Cookie.Ysbweb : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\
[email protected][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temp\iinstall.exe -> TrojanDownloader.IstBar.ku : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\61BF72RD\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\61BF72RD\AppWrap[2].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\B67EIAN6\upd208[1].exe -> Spyware.Look2Me : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\U3KNQU5W\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\RECYCLER\NPROTECT\00083027.exe -> Adware.BetterInternet : Cleaned with backup
C:\RECYCLER\NPROTECT\00083036.exe -> Adware.BetterInternet : Cleaned with backup
C:\RECYCLER\NPROTECT\00083066.dll -> Spyware.ImiBar : Cleaned with backup
C:\RECYCLER\NPROTECT\00083181.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll -> Spyware.EliteBar : Cleaned with backup
C:\WINDOWS\system32\bbchk.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\WINDOWS\system32\elitebfk32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitecoa32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitedcr32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteddv32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitedfp32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitedpe32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitedri32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteehs32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteetf32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteetu32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitegje32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitegrk32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitegut32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitegva32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitehaf32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitehom32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteiff32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitejng32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitejsp32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitejzz32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteknn32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitekyc32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitekys32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitelgf32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitelgp32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitelhg32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitemom32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitenkp32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitennw32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitennz32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitenps32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteoho32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitepeu32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitepmx32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteppo32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitesik32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitetnf32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitetps32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteuhl32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitevbh32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitexai32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitexaw32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitexdx32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitexlk32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitexom32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteybz32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteycd32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteyit32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\eliteyun32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\elitezju32.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\qiljst.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\tdtb.exe -> Trojan.Imiserv.c : Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@qksrv[2].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\WINDOWS\Temp\upd208.exe -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\wupdt.exe -> TrojanDownloader.Intexp.c : Cleaned with backup
::Report End
Now here's the Panda/Active Scan:
Incident Status Location
Adware:Adware/Transponder No disinfected c:\windows\system32\oqaosj.exe
Adware:adware/cws No disinfected C:\DOCUMENTS AND SETTINGS\OWNER\FAVORITES\GOING PLACES\Air Tickets.lnk
Adware:adware/look2me No disinfected C:\WINDOWS\SYSTEM32\guard.tmp
Adware:adware/e2give No disinfected C:\WINDOWS\DOWNLOADED PROGRAM FILES\UGO20.exe
Spyware:spyware/yoursitebar No disinfected C:\WINDOWS\DOWNLOADED PROGRAM FILES\YSBactivex.dll
Adware:adware/keenvalue No disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho
Adware:adware/bookedspace No disinfected C:\WINDOWS\cfgmgr52.ini
Adware:adware/twain-tech No disinfected C:\WINDOWS\smdat32a.sys
Adware:adware/consumeralertsystemNo disinfected C:\PROGRAM FILES\CasStub
Adware:adware/elitebar No disinfected C:\DOCUMENTS AND SETTINGS\OWNER\FAVORITES\Finances & Business
Adware:adware/aurora No disinfected HKEY_CURRENT_USER\SOFTWARE\AURORA
Spyware:spyware/searchcentrix No disinfected HKEY_CURRENT_USER\SOFTWARE\DYNAMIC TOOLBAR
Adware:adware/mywebsearch No disinfected HKEY_CURRENT_USER\SOFTWARE\MYWEBSEARCH
Adware:adware/ieplugin No disinfected HKEY_CLASSES_ROOT\IMITOOLBAR.BOTTOMFRAME.1
Adware:adware/myway No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\MYWAY
Spyware:spyware/media-motor No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\REVISIONS
Adware:adware/navhelper No disinfected HKEY_CLASSES_ROOT\CLSID\{BDF3E430-B101-42AD-A544-FADC6B084872}
Spyware:spyware/istbar No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP MANAGEMENT\ARPCACHE\ISTSVC
Adware:adware/memorywatcher No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP MANAGEMENT\ARPCACHE\MEMORYWATCHER
Spyware:spyware/altnet No disinfected HKEY_CLASSES_ROOT\Interface\{582AB125-1403-42FB-9EFB-198690BA1496}
Adware:adware/mediatickets No disinfected HKEY_CLASSES_ROOT\Interface\{00ada225-ea6c-4fb3-82e8-68189201ccb9}
Adware:adware/brilliantdigitalNo disinfected HKEY_CLASSES_ROOT\Interface\{48E59292-9880-11CF-9754-00AA00C00908}
Adware:Adware/PurityScan No disinfected C:\Program Files\apsi\wtta.exe
Adware:Adware/ConsumerAlertSystemNo disinfected C:\Program Files\Cas\Client\Uninstall.exe
Spyware:Spyware/Bridge No disinfected C:\Program Files\Common Files\Symantec Shared\UndoData\801.sud
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\casino.bmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\dating.bmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\drugs.bmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\fav.bmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\virus.bmp
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\inf\bi6.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\Nail.exe
Adware:Adware/Transponder No disinfected C:\WINDOWS\svcproc.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\amsnt.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\apycfilt.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\aRaamon.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\awsldp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ccgmgr32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\clmres.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cmyptui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dDd8thk.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dgdlgs.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\djsapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dqband.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dqcprop.dll
Adware:Adware/Transponder No disinfected C:\WINDOWS\system32\DrPMon.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dulayx.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dxskcopy.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dzmv2clt.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\elent97.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\frusd.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\guard.tmp
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\haicons.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\hdzlnt08.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\hiicons.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\hsink.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ibxrtmgr.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ifrtrmgr.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iFsrecst.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ikircl.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iklogmsg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iNlmdd5.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\inxsap.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\irfxhk.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iSlmdd5.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iuxsap.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ixengine.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\jmt500.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kedbe.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kidfc.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kmdcan.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kmdhe220.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mchtmled.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mdrd3x40.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mjjint40.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mlscp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mni.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mNpi32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mxhcp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\myxml2.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ndtcfgx.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ndwmsdrm.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nlmsmgr.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nlptools.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nltcfgx.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nnwdev.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nttcfgx.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nwwrsru.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\obbcp32r.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ogjsel.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\okexl32.dll
Adware:Adware/Transponder No disinfected C:\WINDOWS\system32\oqaosj.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\osbcji32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\otedlg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pbbase.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pbrpnsp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pLnmap.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\prgfilt.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pwrpnsp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pyapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\qaery.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\QBENCLIB.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\qfcsinet.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\QFON32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\qiap.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rhgapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rhutils.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rPsctrs.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rrnd.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rVsauto.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rwutils.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\scclogon.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sccpack.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ScnthCore11Resources.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\SEDisply.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sFfrcdlg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\shcfiles.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\smextspk.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\swrio800.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\SX1thk32.dll
Edited by anothersuitcase, 19 July 2005 - 02:13 PM.