Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

infected by Aurora / ABI [CLOSED]


  • This topic is locked This topic is locked

#1
ivyfiore

ivyfiore

    New Member

  • Member
  • Pip
  • 8 posts
I've scanned my computer using Norton Anti-Virus / Internet Security and Microsoft Anti-Spyware, but I still can't shake this Aurora.

Here's my hijack this log. What do I do now? Please help!

Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 9:52:22 PM, on 7/29/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\RioMSC.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\ivrusvc.exe
c:\windows\system32\pubzxri.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\DOCUME~1\BETHME~1\LOCALS~1\Temp\sysnet.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\aoqqan.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\System32\??pPatch\logonui.exe
C:\Program Files\rdso\eetu.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Beth Mellen\Desktop\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\notepad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{0026AD90-C86F-4269-97F3-DAB4897C6D06} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll (file missing)
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Jsxiofpo] C:\Program Files\Vpnv\Khjtkvq.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\BETHME~1\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\aoqqan.exe reg_run
O4 - HKLM\..\Run: [pxkpdll] C:\WINDOWS\pxkpdll.exe
O4 - HKLM\..\Run: [pxkpenc] C:\WINDOWS\pxkpenc.exe
O4 - HKLM\..\Run: [snesdll] C:\WINDOWS\snesdll.exe
O4 - HKLM\..\Run: [zzbdenc] C:\WINDOWS\zzbdenc.exe
O4 - HKLM\..\Run: [estldll] C:\WINDOWS\estldll.exe
O4 - HKLM\..\Run: [estlenc] C:\WINDOWS\estlenc.exe
O4 - HKLM\..\Run: [cmkrul] c:\windows\system32\pubzxri.exe r
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Nwx] C:\WINDOWS\System32\??pPatch\logonui.exe
O4 - HKCU\..\Run: [Aida] C:\Program Files\rdso\eetu.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab27513.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.co...snmusax2918.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\MJBSYNC.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\System32\RioMSC.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS\ivrusvc.exe
  • 0

Advertisements


#2
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Welcome to GTG.

Please download Ewido Security Suite at http://www.ewido.net/en/download/.

1. Install Ewido Security Suite.
2. When installing, under 'Additional Options' uncheck:
* Install background guard
* Install scan via context menu
3. Launch Ewido, there should be an icon on your desktop, double-click it.
4. The program will now open to the main screen.
5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment.
6. You will need to update Ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on Start Update.
7. The update will start and a progress bar will show the updates being installed.
(the status bar at the bottom will display 'Update successful')
8. Exit Ewido. DO NOT scan yet.

If you are having problems with the updater, you can go to http://www.ewido.net...wnload/updates/ to update manually.

Download CCleaner at http://www.ccleaner.com/ccdownload.asp and install it, but do not run it yet.

Please download Nailfix Utility at http://www.noidea.us...050711214630636 Save it to your desktop. Do NOT run it yet.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Once in Safe Mode, double-click on nailfix.exe.
Click 'Next' in the setup, then make sure 'Run Nailfix' is checked and click 'Finish'.
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Now open Ewido and do a scan on your system.

* Click on scanner
* Click on Complete System Scan and the scan will begin.
* NOTE: During some scans with Ewido it is finding cases of false positives.
o You will need to step through the process of cleaning files one-by-one.
o If Ewido detects a file you KNOW to be legitimate, select none as the action.
o Do NOT select 'Perform action on all infections'
o If you are unsure of any entry found, select none for now as the action.
* Once the scan has completed, there will be a button located on the bottom of the screen named Save report
* Click Save report.
* Save the report .txt file to your desktop or a location where you can find it easily.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R3 - URLSearchHook: (no name) - _{0026AD90-C86F-4269-97F3-DAB4897C6D06} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll (file missing)
O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Jsxiofpo] C:\Program Files\Vpnv\Khjtkvq.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\BETHME~1\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\aoqqan.exe reg_run
O4 - HKLM\..\Run: [pxkpdll] C:\WINDOWS\pxkpdll.exe
O4 - HKLM\..\Run: [pxkpenc] C:\WINDOWS\pxkpenc.exe
O4 - HKLM\..\Run: [snesdll] C:\WINDOWS\snesdll.exe
O4 - HKLM\..\Run: [zzbdenc] C:\WINDOWS\zzbdenc.exe
O4 - HKLM\..\Run: [estldll] C:\WINDOWS\estldll.exe
O4 - HKLM\..\Run: [estlenc] C:\WINDOWS\estlenc.exe
O4 - HKLM\..\Run: [cmkrul] c:\windows\system32\pubzxri.exe r
O4 - HKCU\..\Run: [Nwx] C:\WINDOWS\System32\??pPatch\logonui.exe
O4 - HKCU\..\Run: [Aida] C:\Program Files\rdso\eetu.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\MJBSYNC.DLL
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS\ivrusvc.exe


NOTE: The 04 entry may have changed names if you have rebooted since posting the log; look for an entry with a similar format, that will always end in a single letter r.

Uninstall Viewpoint, WebSpecials and Ebates from the Add/Remove panel.

Locate and delete the following:

c:\windows\system32\pubzxri.exe (or whatever the name may have changed to, as noted above).
C:\WINDOWS\ivrusvc.exe
C:\Program Files\Viewpoint\
C:\WINDOWS\System32\aoqqan.exe
C:\WINDOWS\System32\??pPatch\logonui.exe
C:\Program Files\rdso\
C:\WINDOWS\Nail.exe
C:\WINDOWS\dsr.dll
C:\Program Files\WebSpecials\
C:\Program Files\Vpnv\
C:\WINDOWS\System32\vidctrl\
C:\WINDOWS\dinst.exe
C:\WINDOWS\System32\aoqqan.exe
C:\WINDOWS\pxkpdll.exe
C:\WINDOWS\pxkpenc.exe
C:\WINDOWS\snesdll.exe
C:\WINDOWS\zzbdenc.exe
C:\WINDOWS\estldll.exe
C:\WINDOWS\estlenc.exe
C:\Program Files\Ebates_MoeMoneyMaker\
C:\WINDOWS\system32\MJBSYNC.DLL
C:\WINDOWS\svcproc.exe
C:\WINDOWS\ivrusvc.exe


Now run CCleaner.

1. Uncheck 'Cookies' under 'Internet Explorer'.
2. If running Firefox: click on the 'Applications' tab and uncheck 'Cookies' under 'Firefox'.
3. Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.

Finally, restart your computer and post a new HijackThis log, as well as the report log from the Ewido scan. Give me this log also:

Download L2MFix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing Enter. This will scan your computer and it may appear nothing is happening. After a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 or any other files in the l2mfix folder until you are asked to do so!
  • 0

#3
ivyfiore

ivyfiore

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Thanks for the speedy reply.

Here's new new hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 11:41:23 AM, on 7/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\System32\??pPatch\logonui.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\RioMSC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\rdso\eetu.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Beth Mellen\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{0026AD90-C86F-4269-97F3-DAB4897C6D06} - (no file)
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [hymcsj] c:\windows\system32\zdkcoba.exe r
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Nwx] C:\WINDOWS\System32\??pPatch\logonui.exe
O4 - HKCU\..\Run: [Aida] C:\Program Files\rdso\eetu.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab27513.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.co...snmusax2918.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\MJBSYNC.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\System32\RioMSC.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Edited by ivyfiore, 30 July 2005 - 10:01 AM.

  • 0

#4
ivyfiore

ivyfiore

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
I think my previous reply was cut short. I'll try to repost the Ewido scan log next, but first:

I ran into two problems as I followed your instructions:

When I restarted the computer after running the Ewido scan in safe mode I got the following message in a RUNDLL dialog box:

An exception occurred while trying to run "C:\WINDOWS\system32\MQDIMAP.DLL",DllGetVersion"




Then, when I tried to run the L2MFix, I got the following error messages:

C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\SYSTEM32\AUTOEXEC.NT. The system file is not suitable for running MS-DOS and Microsoft Windows Applications. Choose 'Close' to terminate the application.
  • 0

#5
ivyfiore

ivyfiore

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:46:50 AM, 7/30/2005
+ Report-Checksum: 991C4F13

+ Scan result:

HKLM\SOFTWARE\Classes\Interface\{EEE4A2E5-9F56-432F-A6ED-F6F625B551E0} -> Dialer.Generic : Ignored
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@2o7[1].txt -> Spyware.Cookie.2o7 : Ignored
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@a.as-us.falkag[1].txt -> Spyware.Cookie.Falkag : Ignored
HKLM\SOFTWARE\AutoLoader -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\AutoLoader\ww711McSVQLZ -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\AutoLoader\ww7N1McSVQLZ -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{E004800A-73C6-4587-B855-98D0CE0C16B1} -> Spyware.BrowserAid : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctap1.ctap -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctap1.ctap\CLSID -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctap1.ctap\CurVer -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctpp1.ctpp -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctpp1.ctpp\CLSID -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctpp1.ctpp\CurVer -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctsr1.ctsr -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctsr1.ctsr\CLSID -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ctsr1.ctsr\CurVer -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{03B800F9-2536-4441-8CDA-2A3E6D15B4F8} -> Spyware.YourSiteBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{05080E6B-A88A-4CFD-8C3D-9B2557670B6E} -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{07E890E3-EF0C-4EA6-9F79-C5749ACA9CC1} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F} -> Spyware.ISTBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{10D7DB96-56DC-4617-8EAB-EC506ABE6C7E} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{1740E1C8-2504-4472-A458-4B6C31A26F5E} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{23BCD361-4B65-428D-880F-CF1588652CC4} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9} -> Spyware.180Solutions : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{2BB15D36-43BE-4743-A3A0-3308F4B1A610} -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{339D8AFF-0B42-4260-AD82-78CE605A9543} -> Spyware.SideFind : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{41700749-A109-4254-AF13-BE54011E8783} -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{42F58F60-9299-4564-9ABD-8E9324844560} -> Spyware.Begin2Search : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{696D1AF8-D0FF-42FD-BD8D-D0B20D64F508} -> Spyware.Begin2Search : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{6CDC3337-01F7-4A79-A4AF-0B19303CC0BE} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{795398D0-DC2F-4118-A69C-592273BA9C2B} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8FC08358-3634-44C7-A8F2-96DC7F39ACD2} -> Spyware.Begin2Search : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{96515724-397E-48C7-8974-86C203E666E1} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{A2BA5E71-5BE3-4007-AC48-157823FB63FB} -> Spyware.Gator : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{A36A5936-CFD9-4B41-86BD-319A1931887F} -> Spyware.SideFind : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{AA4939C3-DECA-4A48-A454-97CD587C0EF5} -> Spyware.ISTBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B288F21C-A144-4CA2-9B70-8AFA1FAE4B06} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B548B7D8-3D03-4AED-A6A1-4251FAD00C10} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{B99A727F-0782-4A71-BCC2-6E1E66414904} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{C2ADDAED-8302-4739-A547-695BB2128154} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD} -> Spyware.180Solutions : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{DE53FA5D-11CC-4CB5-8D8E-EB5AA59C1E5A} -> Spyware.Begin2Search : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{DFBCC1EB-B149-487E-80C1-CC1562021542} -> Spyware.YourSiteBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{E38924F7-F290-4C13-BEEC-E8C587F58128} -> Spyware.Begin2Search : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{FA82A7EC-2AFC-4EE0-8F83-3229F7C6437E} -> Spyware.Begin2Search : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{0DC5CD7C-F653-4417-AA43-D457BE3A9622} -> Spyware.BookedSpace : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{12EE7A5E-0674-42F9-A76C-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{458BE2D9-F8DB-43D1-A7EF-73E29C4EF9B6} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{4EE12B71-AA5E-45EC-8666-2DB3AD3FDF44} -> Spyware.YourSiteBar : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{58634367-D62B-4C2C-86BE-5AAC45CDB671} -> Spyware.SideFind : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA} -> Spyware.180Solutions : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{64440E59-A0DD-421C-AA4B-268141D764BB} -> Spyware.Begin2Search : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429} -> Spyware.ISTBar : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{8642D0F2-37CC-46B7-AA5B-399E6E68C626} -> Spyware.Gator : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{953F9256-6261-492B-AE38-73B499ADE67F} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{9938040F-08AE-4142-86BC-4E9E9C3C535F} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{B952F0C1-D3B8-4807-BD4B-AE7528EF7509} -> Spyware.EzSearchBar : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{D0288A41-9855-4A9B-8316-BABE243648DA} -> Spyware.SideFind : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{D0C29A75-7146-4737-98EE-BC4D7CF44AF9} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{E0D3B292-A0B0-4640-975C-2F882E039F52} -> Spyware.AdDestroyer : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\AMeOpt -> Spyware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DisplayUtility -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows SR 3.0 -> Spyware.BlazeFind : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows SR 3.0\- -> Spyware.BlazeFind : Cleaned with backup
HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\Policies\Avenue Media -> Spyware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\SearchUpgrader -> Spyware.KeenValue : Cleaned with backup
HKLM\SOFTWARE\SearchUpgrader\{7EE60CF1-2DFF-41B5-91C9-9C1C518053FC} -> Spyware.KeenValue : Cleaned with backup
[212] C:\WINDOWS\system32\MJBSYNC.DLL -> Spyware.Look2Me : Error during cleaning
[624] C:\WINDOWS\system32\KXDIT.DLL -> Spyware.Look2Me : Error during cleaning
[876] c:\windows\system32\tuykjf.exe -> Adware.BetterInternet : Cleaned with backup
[1448] C:\WINDOWS\system32\KXDIT.DLL -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@112.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@abetterinternet[1].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ad-logics[2].txt -> Spyware.Cookie.Ad-logics : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ad.adition[2].txt -> Spyware.Cookie.Adition : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@adopt.specificclick[1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ads.addynamix[1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ads.enliven[1].txt -> Spyware.Cookie.Enliven : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ads.euniverseads[2].txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ads.pointroll[2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ads.specificpop[2].txt -> Spyware.Cookie.Specificpop : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ads.valuead[1].txt -> Spyware.Cookie.Valuead : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ads.x10[1].txt -> Spyware.Cookie.X10 : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@as-us.falkag[1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@baby.valueclick[2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@bfast[1].txt -> Spyware.Cookie.Bfast : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@bilbo.counted[2].txt -> Spyware.Cookie.Counted : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@bs.serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@centrport[2].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@citi.bridgetrack[1].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@clickagents[1].txt -> Spyware.Cookie.Clickagents : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@commission-junction[1].txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@counter.hitslink[2].txt -> Spyware.Cookie.Hitslink : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@data.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@edge.ru4[2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-aol.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-att.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-bestbuy.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-brooksbrothers.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-buytelco.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-cafepress.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-capitalgroup.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-cbs.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-comcast.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-dig.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-elecbusiness.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-foundation.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-foxsports.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-hyundaiusa.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-idg.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-mh.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-mindshare.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-mtv.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-netquote.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-salonmedia.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-sonypictures.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-theviptour.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-timeinc.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-uniontrib.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-usoc.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg-xoomcorp.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@ehg.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@euniverseads[2].txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@findwhat[1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@gator[2].txt -> Spyware.Cookie.Gator : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@hg1.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@hotlog[1].txt -> Spyware.Cookie.Hotlog : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@hypertracker[1].txt -> Spyware.Cookie.Hypertracker : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@internetfuel[1].txt -> Spyware.Cookie.Internetfuel : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@linksynergy[2].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@mediaplex[2].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@perf.overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@phg.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@qksrv[1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@rccl.bridgetrack[2].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@revenue[2].txt -> Spyware.Cookie.Revenue : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@rotator.adjuggler[1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@sales.liveperson[1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@servedby.valuead[1].txt -> Spyware.Cookie.Valuead : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@server.iad.liveperson[1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@spinbox[1].txt -> Spyware.Cookie.Spinbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@stat.onestat[1].txt -> Spyware.Cookie.Onestat : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@statcounter[2].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@targetnet[2].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@test.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@trafic[1].txt -> Spyware.Cookie.Trafic : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@twci.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@valueclick[2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@valueclick[3].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@w135.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@web4.realtracker[1].txt -> Spyware.Cookie.Realtracker : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@www4.paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@www6.paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyqhc5alogydj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnycldpglpgydj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Application Data\Earthlink\6.0\mellenemd@earthlink.net\Cookies\beth mellen@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ad-logics[2].txt -> Spyware.Cookie.Ad-logics : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@adorigin[2].txt -> Spyware.Cookie.Adorigin : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ads.addynamix[1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ads.pointroll[1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@adtech[2].txt -> Spyware.Cookie.Adtech : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@adviva[1].txt -> Spyware.Cookie.Adviva : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@as-us.falkag[1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@banner.goldenpalace[2].txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@banner.kiwicasino[2].txt -> Spyware.Cookie.Kiwicasino : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@bfast[1].txt -> Spyware.Cookie.Bfast : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@bilbo.counted[1].txt -> Spyware.Cookie.Counted : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@bs.serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@casinotropez[2].txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@centrport[2].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@citi.bridgetrack[1].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@clickagents[1].txt -> Spyware.Cookie.Clickagents : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@counter.hitslink[1].txt -> Spyware.Cookie.Hitslink : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@cratebarrel.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@data.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-bestbuy.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-bskyb.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-cbs.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-cinemanowinc.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-console.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-datamonitor.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-dig.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-foxsports.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-knightridder.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-lowermybills.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-mindshare.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-playboy.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-razorgator.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-shopathome.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg-spafinder.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ehg.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@findwhat[1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@goldenpalace[2].txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@hg1.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@hypertracker[1].txt -> Spyware.Cookie.Hypertracker : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@ivwbox[2].txt -> Spyware.Cookie.Ivwbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@kiwicasino[2].txt -> Spyware.Cookie.Kiwicasino : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@linksynergy[2].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@mv.valueclick[2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@perf.overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@phg.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@premiumnetworkrocks.valuead[2].txt -> Spyware.Cookie.Valuead : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@pro-market[2].txt -> Spyware.Cookie.Pro-market : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@qksrv[2].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@questionmarket[2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@revenue[1].txt -> Spyware.Cookie.Revenue : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@sel.as-us.falkag[2].txt -> Spyware.Cookie.Falkag : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@server.iad.liveperson[2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@statcounter[1].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@statse.webtrendslive[2].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@targetnet[1].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@tribalfusion[2].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@twci.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@valuead[1].txt -> Spyware.Cookie.Valuead : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@valueclick[3].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@vegasred[2].txt -> Spyware.Cookie.Vegasred : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@www.burstnet[1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@www.casinotropez[1].txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@www.goldenpalace[1].txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@www.myaffiliateprogram[1].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@www.shopathomeselect[2].txt -> Spyware.Cookie.Shopathomeselect : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@www.sidefind[2].txt -> Spyware.Cookie.Sidefind : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@www.smartadserver[2].txt -> Spyware.Cookie.Smartadserver : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@www.vegasred[1].txt -> Spyware.Cookie.Vegasred : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@xxxtoolbar[2].txt -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Cookies\beth mellen@z1.adserver[2].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\b.com -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@ads.addynamix[1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@questionmarket[2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Cookies\beth mellen@twci.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\senh.exe -> TrojanDropper.Delf.dj : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Temporary Internet Files\Content.IE5\8D1140SL\Params[17].htm -> Spyware.BookedSpace : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Temporary Internet Files\Content.IE5\MCNCV68R\Params[17].htm -> Spyware.BookedSpace : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temp\Temporary Internet Files\Content.IE5\MCNCV68R\Params[1].htm -> Spyware.BookedSpace : Cleaned with backup
C:\Documents and Settings\Beth Mellen\Local Settings\Temporary Internet Files\Content.IE5\KPYJC5Y3\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@bs.serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@casalemedia[2].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@ehg-foxsports.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@findwhat[1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@pro-market[1].txt -> Spyware.Cookie.Pro-market : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@qksrv[1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@questionmarket[2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@servedby.advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@server.iad.liveperson[2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@specificclick[1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@twci.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@valueclick[2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Cookies\cate mellen@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Local Settings\Temporary Internet Files\Content.IE5\6JYLAZOX\0,1817,154183-246198,00[2].html -> Spyware.BookedSpace : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Local Settings\Temporary Internet Files\Content.IE5\OT2JQP0H\0,1-0,salmon_filet,FF[2].html -> Spyware.BookedSpace : Cleaned with backup
C:\Documents and Settings\Cate Mellen\Local Settings\Temporary Internet Files\Content.IE5\OT2JQP0H\0,1717,153174-232204,00[2].html -> Spyware.BookedSpace : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\beth mellen@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\74423429-02C2-4DAF-8004-C158CD\68B763BC-1A41-4808-82C1-9F6599 -> TrojanDownloader.Braidupdate.d : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\A7ED1F15-9EDE-45CC-964F-F2A6A4\C98634FA-AA93-43AF-8D15-8B8004 -> Spyware.WebSpecial : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\DA42D8BF-4327-4A2B-8B81-0E5704\B0C7499A-983E-4B4F-81CC-8F444D -> Spyware.DashBar : Cleaned with backup
C:\RECYCLER\S-1-5-21-3355924161-1422163625-3880996892-500\Dc10 -> TrojanDownloader.Small.asf : Cleaned with backup
C:\RECYCLER\S-1-5-21-3355924161-1422163625-3880996892-500\Dc12 -> TrojanDownloader.Small.asf : Cleaned with backup
C:\RECYCLER\S-1-5-21-3355924161-1422163625-3880996892-500\Dc13 -> TrojanDownloader.Small.asf : Cleaned with backup
C:\WINDOWS\ektcbz.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\SYSTEM32\dbrro.dll -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\fhsui.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\flaajsd.dll -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\hHshlib.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\HRDLR32.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\jZvart.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\KDDRU1.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\KLDSG.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\Lvpng11n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\lVprxy.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\MDLS31.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\MLOEACCT.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\MPBSYNC.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\MXRAPI.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\SBCPACK.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\tcflog.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\tuykjf.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\SYSTEM32\weird.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\WINDOWS\Temp\upd208.exe -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\Temp\upd209.exe -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\visfxun.exe -> TrojanDownloader.VB.kd : Cleaned with backup


::Report End
  • 0

#6
ivyfiore

ivyfiore

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Plus the log from a second Ewido scan I did for good measure:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:59:11 AM, 7/30/2005
+ Report-Checksum: 33E3D198

+ Scan result:

HKLM\SOFTWARE\Classes\Interface\{EEE4A2E5-9F56-432F-A6ED-F6F625B551E0} -> Dialer.Generic : Cleaned with backup
[212] C:\WINDOWS\system32\MJBSYNC.DLL -> Spyware.Look2Me : Error during cleaning
[624] C:\WINDOWS\system32\KXDIT.DLL -> Spyware.Look2Me : Error during cleaning
[1448] VM_00A10000 -> Adware.BetterInternet : Error during cleaning
[1648] c:\windows\system32\zdkcoba.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\SYSTEM32\zdkcoba.exe -> Adware.BetterInternet : Cleaned with backup


::Report End
  • 0

#7
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
I thought there was an entry to fix that up in L2MFix though? OK, let's do this manually then:

Copy autoexec.nt from the C:\WINDOWS\repair folder to C:\WINDOWS\system32 folder. Now try running L2MFix with option #1.

After you ran that, post the log here and do the following immediately (make sure you posted the log from option #1 first though):

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing Enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2MFix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new HijackThis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
  • 0

#8
ivyfiore

ivyfiore

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
OK, the original problem is gone, but now I get an error message that says:

C:\Docume~1\BETHME~1\Desktop\l2mfix\report.txt is not a valid Win32 application
  • 0

#9
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
You get this when running option #1 or #2? Try renaming that report.txt to something like reportOLD.txt and run L2MFix again.
  • 0

#10
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP