[Aslion]

Help!!

I am running Windows XP. A day or two ago I lost my Desktop, so I am running everything through Task Manager. I have run Ewido and removed about 5,000 malware items, but I cannot get the desktop back.


HiJack this log follows:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {44E1228B-66A2-AE62-B1EA-8476485181C4} - C:\WINDOWS\sdkmk32.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [uz1P] C:\windows\temp\uz1P.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [syshn.exe] C:\WINDOWS\system32\syshn.exe
O4 - HKLM\..\Run: [sysbc.exe] C:\WINDOWS\system32\sysbc.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Egnsxs.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QAGENT] C:\PROGRAM FILES\QUICKENW\QAGENT.EXE
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [netfu.exe] C:\WINDOWS\system32\netfu.exe
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [LSASS Authority] lshosts32.exe
O4 - HKLM\..\Run: [kxnJUqWZ.exe] c:\windows\system32\kxnJUqWZ.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Eqy3T8tFy] C:\windows\system32\Eqy3T8tFy.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [criq.exe] C:\WINDOWS\system32\criq.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [appnm.exe] C:\WINDOWS\system32\appnm.exe
O4 - HKLM\..\Run: [apivy.exe] C:\WINDOWS\system32\apivy.exe
O4 - HKLM\..\Run: [apiqk.exe] C:\WINDOWS\system32\apiqk.exe
O4 - HKLM\..\Run: [apild.exe] C:\WINDOWS\system32\apild.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [addzm.exe] C:\WINDOWS\system32\addzm.exe
O4 - HKLM\..\Run: [addty.exe] C:\WINDOWS\system32\addty.exe
O4 - HKLM\..\Run: [7smU3te] iplsync.exe
O4 - HKLM\..\Run: [7bjiq3os] C:\WINDOWS\System32\7bjiq3os.exe
O4 - HKLM\..\Run: [2P6WFAX43ZHE7C] C:\WINDOWS\System32\Dqk5Y.exe
O4 - HKLM\..\Run: [zqtixtzkde] C:\WINDOWS\System32\uwrhhn.exe
O4 - HKLM\..\Run: [Windows Authority Service] C:\WINDOWS\\\\\\\\\\\
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Hqsyiz.exe
O4 - HKLM\..\Run: [javawb32.exe] C:\WINDOWS\system32\javawb32.exe
O4 - HKLM\..\Run: [javams.exe] C:\WINDOWS\system32\javams.exe
O4 - HKLM\..\Run: [javalr.exe] C:\WINDOWS\system32\javalr.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1122598433\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [ftjukg] c:\windows\system32\nhgbbr.exe r
O4 - HKLM\..\RunServices: [LSASS Authority] lshosts32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKCU\..\Run: [MB58RjK5l] ikmedsvc.exe
O4 - HKCU\..\Run: [kkof] C:\PROGRA~1\COMMON~1\kkof\kkofm.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Local runole service] C:\WINDOWS\System32\srvc32.exe
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {00BE02D9-D7A1-4BBD-86A3-0B5164FE8B8A} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {00BE02D9-D7A1-4BBD-86A3-0B5164FE8B8A} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {4E204D4B-98BD-4362-954C-98D8264923BD} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4E204D4B-98BD-4362-954C-98D8264923BD} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EA8F5147-BCCB-4B2B-ABF2-6729502FBAEE} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EA8F5147-BCCB-4B2B-ABF2-6729502FBAEE} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Internet Explorer\PLUGINS\Npswf16.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.co...m-ob-assets.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai....r31/brix6ie.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...s/yinst0401.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildt...iveLauncher.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.co...ysb_1002245.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1101077960607
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O16 - DPF: {9F9D2D68-4980-4763-B769-510A30F2C7BC} (SvrWrapperCtl Control) - https://targetreward...rWrapperCtl.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildt...orts/wtinst.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\apiyo32.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mouse Movement Monitor (mousemm) - Unknown owner - C:\WINDOWS\System32\mousemm.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[Advertisements]

Hello and Welcome.

Could you please post a new Hijack log from the very top to the very bottom please. I need to see everything

Thanks

[loophole]

Hello and Welcome.

Could you please post a new Hijack log from the very top to the very bottom please. I need to see everything

Thanks

[Aslion]

Logfile of HijackThis v1.99.1
Scan saved at 5:24:21 PM, on 8/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {44E1228B-66A2-AE62-B1EA-8476485181C4} - C:\WINDOWS\sdkmk32.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [uz1P] C:\windows\temp\uz1P.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [syshn.exe] C:\WINDOWS\system32\syshn.exe
O4 - HKLM\..\Run: [sysbc.exe] C:\WINDOWS\system32\sysbc.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Egnsxs.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QAGENT] C:\PROGRAM FILES\QUICKENW\QAGENT.EXE
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [netfu.exe] C:\WINDOWS\system32\netfu.exe
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [LSASS Authority] lshosts32.exe
O4 - HKLM\..\Run: [kxnJUqWZ.exe] c:\windows\system32\kxnJUqWZ.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Eqy3T8tFy] C:\windows\system32\Eqy3T8tFy.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [criq.exe] C:\WINDOWS\system32\criq.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [appnm.exe] C:\WINDOWS\system32\appnm.exe
O4 - HKLM\..\Run: [apivy.exe] C:\WINDOWS\system32\apivy.exe
O4 - HKLM\..\Run: [apiqk.exe] C:\WINDOWS\system32\apiqk.exe
O4 - HKLM\..\Run: [apild.exe] C:\WINDOWS\system32\apild.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [addzm.exe] C:\WINDOWS\system32\addzm.exe
O4 - HKLM\..\Run: [addty.exe] C:\WINDOWS\system32\addty.exe
O4 - HKLM\..\Run: [7smU3te] iplsync.exe
O4 - HKLM\..\Run: [7bjiq3os] C:\WINDOWS\System32\7bjiq3os.exe
O4 - HKLM\..\Run: [2P6WFAX43ZHE7C] C:\WINDOWS\System32\Dqk5Y.exe
O4 - HKLM\..\Run: [zqtixtzkde] C:\WINDOWS\System32\uwrhhn.exe
O4 - HKLM\..\Run: [Windows Authority Service] C:\WINDOWS\\\\\\\\\\\
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Hqsyiz.exe
O4 - HKLM\..\Run: [javawb32.exe] C:\WINDOWS\system32\javawb32.exe
O4 - HKLM\..\Run: [javams.exe] C:\WINDOWS\system32\javams.exe
O4 - HKLM\..\Run: [javalr.exe] C:\WINDOWS\system32\javalr.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1122598433\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [ftjukg] c:\windows\system32\nhgbbr.exe r
O4 - HKLM\..\RunServices: [LSASS Authority] lshosts32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKCU\..\Run: [MB58RjK5l] ikmedsvc.exe
O4 - HKCU\..\Run: [kkof] C:\PROGRA~1\COMMON~1\kkof\kkofm.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Local runole service] C:\WINDOWS\System32\srvc32.exe
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {00BE02D9-D7A1-4BBD-86A3-0B5164FE8B8A} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {00BE02D9-D7A1-4BBD-86A3-0B5164FE8B8A} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {4E204D4B-98BD-4362-954C-98D8264923BD} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4E204D4B-98BD-4362-954C-98D8264923BD} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EA8F5147-BCCB-4B2B-ABF2-6729502FBAEE} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EA8F5147-BCCB-4B2B-ABF2-6729502FBAEE} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Internet Explorer\PLUGINS\Npswf16.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.co...m-ob-assets.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai....r31/brix6ie.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...s/yinst0401.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildt...iveLauncher.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.co...ysb_1002245.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1101077960607
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O16 - DPF: {9F9D2D68-4980-4763-B769-510A30F2C7BC} (SvrWrapperCtl Control) - https://targetreward...rWrapperCtl.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildt...orts/wtinst.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\apiyo32.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mouse Movement Monitor (mousemm) - Unknown owner - C:\WINDOWS\System32\mousemm.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Sorry, I was away for a few days.

[loophole]

Hello Aslion

We have alot of work to do. The first thing I need you to do is download service pack one here Without it you will keep getting reinfected. Do not get service pack 2 please. After that reboot and post a new log in this same thread.

Thanks

[Aslion]

Logfile of HijackThis v1.99.1
Scan saved at 10:49:34 PM, on 8/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {44E1228B-66A2-AE62-B1EA-8476485181C4} - C:\WINDOWS\sdkmk32.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [uz1P] C:\windows\temp\uz1P.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [syshn.exe] C:\WINDOWS\system32\syshn.exe
O4 - HKLM\..\Run: [sysbc.exe] C:\WINDOWS\system32\sysbc.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Egnsxs.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QAGENT] C:\PROGRAM FILES\QUICKENW\QAGENT.EXE
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [netfu.exe] C:\WINDOWS\system32\netfu.exe
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [LSASS Authority] lshosts32.exe
O4 - HKLM\..\Run: [kxnJUqWZ.exe] c:\windows\system32\kxnJUqWZ.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Eqy3T8tFy] C:\windows\system32\Eqy3T8tFy.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [criq.exe] C:\WINDOWS\system32\criq.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [appnm.exe] C:\WINDOWS\system32\appnm.exe
O4 - HKLM\..\Run: [apivy.exe] C:\WINDOWS\system32\apivy.exe
O4 - HKLM\..\Run: [apiqk.exe] C:\WINDOWS\system32\apiqk.exe
O4 - HKLM\..\Run: [apild.exe] C:\WINDOWS\system32\apild.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [addzm.exe] C:\WINDOWS\system32\addzm.exe
O4 - HKLM\..\Run: [addty.exe] C:\WINDOWS\system32\addty.exe
O4 - HKLM\..\Run: [7smU3te] iplsync.exe
O4 - HKLM\..\Run: [7bjiq3os] C:\WINDOWS\System32\7bjiq3os.exe
O4 - HKLM\..\Run: [2P6WFAX43ZHE7C] C:\WINDOWS\System32\Dqk5Y.exe
O4 - HKLM\..\Run: [zqtixtzkde] C:\WINDOWS\System32\uwrhhn.exe
O4 - HKLM\..\Run: [Windows Authority Service] C:\WINDOWS\\\\\\\\\\\
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Hqsyiz.exe
O4 - HKLM\..\Run: [javawb32.exe] C:\WINDOWS\system32\javawb32.exe
O4 - HKLM\..\Run: [javams.exe] C:\WINDOWS\system32\javams.exe
O4 - HKLM\..\Run: [javalr.exe] C:\WINDOWS\system32\javalr.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1122598433\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [ftjukg] c:\windows\system32\nhgbbr.exe r
O4 - HKLM\..\RunServices: [LSASS Authority] lshosts32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKCU\..\Run: [MB58RjK5l] ikmedsvc.exe
O4 - HKCU\..\Run: [kkof] C:\PROGRA~1\COMMON~1\kkof\kkofm.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Local runole service] C:\WINDOWS\System32\srvc32.exe
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {00BE02D9-D7A1-4BBD-86A3-0B5164FE8B8A} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {00BE02D9-D7A1-4BBD-86A3-0B5164FE8B8A} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {4E204D4B-98BD-4362-954C-98D8264923BD} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4E204D4B-98BD-4362-954C-98D8264923BD} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EA8F5147-BCCB-4B2B-ABF2-6729502FBAEE} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EA8F5147-BCCB-4B2B-ABF2-6729502FBAEE} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Internet Explorer\PLUGINS\Npswf16.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.co...m-ob-assets.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai....r31/brix6ie.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...s/yinst0401.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildt...iveLauncher.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.co...ysb_1002245.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1101077960607
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O16 - DPF: {9F9D2D68-4980-4763-B769-510A30F2C7BC} (SvrWrapperCtl Control) - https://targetreward...rWrapperCtl.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildt...orts/wtinst.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\apiyo32.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mouse Movement Monitor (mousemm) - Unknown owner - C:\WINDOWS\System32\mousemm.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

okay, now what?

Thanks!

[loophole]

Hello Aslion

You have a multitude of infections. We will go at them one or two at a time.If this first step goes well we can get your desktop back in the next step. Just follow the instructions as best you can .

First, we need to remove the Peper trojan.

• Download uninst.exe from HERE
• Double-click uninst.exe to run it.
• Let it terminate (it'll just blink briefly on your screen and won't appeared to have done much--this is normal)

You have a nasty About:Blank infection. This fix requires several tools that need to be downloaded. Please download these now, we will run them later.

1) About:Buster - Download it and extract it to C:/aboutbuster.
2) Download and install CleanUp! Here
but do not run it yet.
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.
3) Download CWShredder here to its own folder.

Update CWShredder

* Open CWShredder and click I AGREE
* Click Check For Update
* Close CWShredder

Please update Ewido

You may wish to print out a copy of these instructions to follow while you complete this procedure


Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the below service:


Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I)


When you find them, double-click on each one. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok.

Run HiJackThis. Click on "None of the above, just start the program". Now, click on the "Config" button (bottom right), then click on "Misc Tools", then click on "Delete an NT Service" a window will pop up. Enter the below item into that field (copy and paste):

11Fßä#·ºÄÖ`I


Click ok. *note* You may need to have a space before the first " 1"

It should pull up information about the service, when it asks if you want to reboot now click YES Please note that after you click yes you will be rebooting into safe mode so start continually tapping the F8 key while your system is starting, select Safe Mode from the menu.

Run AboutBuster
-Click Start to begin the process
-Click OK on the Buster Report dialogue box to start the scan
AboutBuster scans the computer for malicious files and deletes them.
Run About buster again ( run it until it doesnt find anything Usually 2-3 times)

Run CWShredder
-Next, click on the: ‘Fix’ button
-Follow the prompts, and press OK

Run CleanUp
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Now open Ewido
[*]Click on scanner
[*]Click on Complete System Scan and the scan will begin.
.
[*]Once the scan has completed, there will be a button located on the bottom of the screen named Save report
[*]Click Save report.
[*]Save the report .txt file to your desktop.
[/list]Now close ewido security suite.

Clean Up the left overs

Run HJT, close any open windows, and fix the following items (if they are still there):


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ldddv.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: (no name) - {44E1228B-66A2-AE62-B1EA-8476485181C4} - C:\WINDOWS\sdkmk32.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [uz1P] C:\windows\temp\uz1P.exe
O4 - HKLM\..\Run: [syshn.exe] C:\WINDOWS\system32\syshn.exe
O4 - HKLM\..\Run: [sysbc.exe] C:\WINDOWS\system32\sysbc.exe
O4 - HKLM\..\Run: [netfu.exe] C:\WINDOWS\system32\netfu.exe
O4 - HKLM\..\Run: [kxnJUqWZ.exe] c:\windows\system32\kxnJUqWZ.exe
O4 - HKLM\..\Run: [appnm.exe] C:\WINDOWS\system32\appnm.exe
O4 - HKLM\..\Run: [apivy.exe] C:\WINDOWS\system32\apivy.exe
O4 - HKLM\..\Run: [apiqk.exe] C:\WINDOWS\system32\apiqk.exe
O4 - HKLM\..\Run: [apild.exe] C:\WINDOWS\system32\apild.exe
O4 - HKLM\..\Run: [2P6WFAX43ZHE7C] C:\WINDOWS\System32\Dqk5Y.exe
O4 - HKLM\..\Run: [zqtixtzkde] C:\WINDOWS\System32\uwrhhn.exe
O4 - HKLM\..\Run: [Windows Authority Service] C:\WINDOWS\\\\\\\\\\\
O9 - Extra button: Microsoft AntiSpyware helper - {00BE02D9-D7A1-4BBD-86A3-0B5164FE8B8A} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {00BE02D9-D7A1-4BBD-86A3-0B5164FE8B8A} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {4E204D4B-98BD-4362-954C-98D8264923BD} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4E204D4B-98BD-4362-954C-98D8264923BD} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EA8F5147-BCCB-4B2B-ABF2-6729502FBAEE} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EA8F5147-BCCB-4B2B-ABF2-6729502FBAEE} - (no file) (HKCU)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildt...iveLauncher.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildt...orts/wtinst.cab

Now click fix checked

Reboot and post a new hijack log and the Ewido log

Edited by loophole, 07 August 2005 - 09:33 PM.

[Aslion]

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 9:45:54 AM, 8/8/2005
+ Report-Checksum: 107E42C

+ Scan result:

C:\Documents and Settings\Owner\Local Settings\Application Data\Wildtangent\Cdacache\00\00\07.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18202375.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18205859.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18206046.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18206265.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18206531.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18207000.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18207156.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208093.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208250.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208437.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208875.asw/C:/WINDOWS/System32/exdl.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208875.asw/C:/WINDOWS/System32/mqexdlm.srg -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208875.asw/C:/WINDOWS/System32/exul.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208875.asw/C:/WINDOWS/System32/javexulm.vxd -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208875.asw/C:/WINDOWS/System32/bbchk.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208875.asw/C:/WINDOWS/System32/msexreg.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18208875.asw/C:/WINDOWS/System32/instsrv.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18209406.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18209968.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18210250.asw/C:/WINDOWS/System32/msbe.dll -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18210250.asw/C:/Program Files/BullsEye Network/bin/bargains.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18210250.asw/C:/Program Files/BullsEye Network/bin/adv.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18210250.asw/C:/Program Files/BullsEye Network/bin/adx.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18210531.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18210796.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18211484.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18211718.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18211968.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18213578.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18213984.asw -> Spyware.ClearSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18214171.asw -> Spyware.ClearSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18215140.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18215890.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18216156.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18216359.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18216843.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18217031.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\18217312.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\32059212.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\32060462.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\32061252.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\32107812.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\32108432.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\32109212.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\32112342.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42546090.asw -> Backdoor.Ruledor.b : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42548591.asw -> TrojanDownloader.Agent.al : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42552182.asw -> Trojan.Bispy.B : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42555624.asw -> TrojanDownloader.Agent.al : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42559066.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42560157.asw -> TrojanDownloader.Agent.al : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42563438.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42565469.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42648901.asw -> Spyware.BadBar : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42651251.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42652341.asw -> Spyware.180Solutions : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42653591.asw -> Spyware.180Solutions : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42656711.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42658431.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42668281.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42671871.asw -> Spyware.180Solutions : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42683121.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42685622.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42687652.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42694062.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42695462.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42696712.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42699372.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42700932.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42704372.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42706252.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42707182.asw -> TrojanDownloader.Agent.al : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42709533.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42711403.asw -> TrojanSpy.Idly.c : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42714373.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42716563.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42717813.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42719533.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42720933.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42724063.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42725153.asw -> TrojanDownloader.Agent.al : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42726403.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42728594.asw -> Backdoor.Ruledor.b : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42729684.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42732964.asw -> TrojanDownloader.Apropo.i : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42734064.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42736094.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42737184.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42738124.asw -> TrojanDownloader.Agent.al : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42761716.asw -> Adware.eZula : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42771257.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42773127.asw -> Backdoor.Ruledor.b : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42774377.asw -> Spyware.ClearSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42777818.asw -> Spyware.ClearSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42778908.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42782188.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42784538.asw -> Spyware.180Solutions : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42786098.asw -> Trojan.Bispy.B : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42835628.asw -> Trojan.Bispy.A : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42837189.asw -> TrojanDownloader.Stubby.a : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42847969.asw -> Spyware.Visicom : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42849539.asw -> TrojanDownloader.Agent.ae : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\42851259.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44331403.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44333433.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44343283.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44351093.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44356713.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44361873.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44363903.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44365623.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44368903.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44374843.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\44379533.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\47806890.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\47808312.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\47808734.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\47809515.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\50987421.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\50988109.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\50989375.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\50989593.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\50989921.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\50990343.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53005421.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53007078.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53011218.asw -> TrojanDownloader.Agent.ap : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53012718.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53013375.asw -> Spyware.Winpup32 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53013750.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53015765.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53016984.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53019406.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53020625.asw -> Adware.eZula : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53021390.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53021609.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53022250.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53513156.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53517265.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53517531.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53517671.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53517906.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53518296.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53518703.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53518984.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53519234.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53519468.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53520250.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53520500.asw/C:/WINDOWS/System32/exdl.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53520500.asw/C:/WINDOWS/System32/exul.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53520500.asw/C:/WINDOWS/System32/javexulm.vxd -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53520640.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53521031.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53521250.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53521593.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53522265.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\53522828.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54755312.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54756125.asw -> TrojanDownloader.Agent.ap : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54756281.asw -> TrojanDownloader.Agent.ap : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54756640.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54757031.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54757218.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54757421.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54757734.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54757906.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54758093.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54758312.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54758468.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54758734.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54758875.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54759078.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54759281.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54759468.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54759656.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54759937.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54760156.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54760421.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54760578.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54760921.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54761109.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54761281.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54761421.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54761609.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54761953.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54762093.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54762296.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54762421.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54762578.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54762875.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54763015.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54763281.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54763468.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54763656.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54763953.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54764109.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54764281.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54764468.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54764609.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54764750.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54765093.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54765234.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54765578.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54765718.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54765906.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54766343.asw -> TrojanDownloader.Agent.ap : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54766656.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54766796.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54766984.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54767140.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54767406.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54767578.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54767875.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54768000.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54768140.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54768343.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54768515.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54768671.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54769015.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54769171.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54769375.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54769796.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54789687.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54793328.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54793515.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54793718.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54794125.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54794359.asw -> Spyware.OneMoreSearch : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54794562.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54794828.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54795390.asw -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54795671.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54796671.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54796906.asw -> TrojanDownloader.Apropo.g : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54797218.asw -> Spyware.180Solutions : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54797671.asw -> Spyware.BiSpy : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54797937.asw -> Spyware.AproposMedia : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54943436.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54949376.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54949846.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54950316.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54951566.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54952036.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54954846.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54955316.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54955786.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54957506.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54957966.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54958596.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54960156.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54960626.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54961256.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54962506.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54962966.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54963596.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54965786.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54966566.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54967036.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54968596.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54969686.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54970626.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54972186.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54972816.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54973286.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54974846.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54975316.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54977506.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54977966.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54978436.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54980006.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54980466.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54981096.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54982656.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54983436.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54983906.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54986096.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54987506.asw -> TrojanDownloader.Agent.ap : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54987966.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54988596.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54989216.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54990626.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54991566.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54992346.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54994846.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54995936.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54996716.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\54999846.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55000626.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55001406.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55002966.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55004376.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55005786.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55010006.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55011566.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55012966.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55013756.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55016716.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55017346.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55018756.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55019216.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55019846.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55021257.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55021717.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55022347.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55022817.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55024067.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55024537.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55025157.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55027967.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55028437.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55029067.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55030157.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55030787.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55032187.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55033437.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55034217.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55035317.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55039067.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55039537.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55040007.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55041257.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55041877.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55042507.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55044067.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55044537.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55045157.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55047817.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55048287.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55048907.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55050467.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55050937.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55051407.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55053127.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55053597.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55054687.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55055317.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55055787.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55059067.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55059687.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55061567.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55064067.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55066877.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55067347.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55067967.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55069377.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55069847.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55070317.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55072037.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55072507.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55073127.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55074377.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55075007.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55075467.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55078437.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55078907.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55079537.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55080007.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55082187.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55082657.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55083287.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55084687.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55085317.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55088597.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55090467.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55090937.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55093757.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55094217.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55094847.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55099687.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55100317.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55100937.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55101407.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55102657.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55103287.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55103757.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55106407.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55106877.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55107507.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55109537.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55110007.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55111097.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55111567.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55112187.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55113437.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55114067.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55114537.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55117037.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55117507.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55118127.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55119217.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55119537.asw -> TrojanDownloader.Agent.ap : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55120317.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55120787.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55121567.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55122187.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55122657.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55124067.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55124537.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55125157.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55127817.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55128438.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55129068.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55130468.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55130938.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55132348.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55132818.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55133438.asw -> Trojan.Feat.2 : Cleaned with backup
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\55134688.asw ->

[Aslion]

Logfile of HijackThis v1.99.1
Scan saved at 1:14:26 AM, on 8/9/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Egnsxs.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QAGENT] C:\PROGRAM FILES\QUICKENW\QAGENT.EXE
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [LSASS Authority] lshosts32.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Eqy3T8tFy] C:\windows\system32\Eqy3T8tFy.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [criq.exe] C:\WINDOWS\system32\criq.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [addzm.exe] C:\WINDOWS\system32\addzm.exe
O4 - HKLM\..\Run: [addty.exe] C:\WINDOWS\system32\addty.exe
O4 - HKLM\..\Run: [7bjiq3os] C:\WINDOWS\System32\7bjiq3os.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Hqsyiz.exe
O4 - HKLM\..\Run: [javawb32.exe] C:\WINDOWS\system32\javawb32.exe
O4 - HKLM\..\Run: [javams.exe] C:\WINDOWS\system32\javams.exe
O4 - HKLM\..\Run: [javalr.exe] C:\WINDOWS\system32\javalr.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1122598433\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [ftjukg] c:\windows\system32\nhgbbr.exe r
O4 - HKLM\..\RunServices: [LSASS Authority] lshosts32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKCU\..\Run: [kkof] C:\PROGRA~1\COMMON~1\kkof\kkofm.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Local runole service] C:\WINDOWS\System32\srvc32.exe
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Internet Explorer\PLUGINS\Npswf16.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.co...m-ob-assets.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai....r31/brix6ie.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...s/yinst0401.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.co...ysb_1002245.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1101077960607
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O16 - DPF: {9F9D2D68-4980-4763-B769-510A30F2C7BC} (SvrWrapperCtl Control) - https://targetreward...rWrapperCtl.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mouse Movement Monitor (mousemm) - Unknown owner - C:\WINDOWS\System32\mousemm.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

The prior post was the Ewido log, this is the post purging HiJack This log. Is there a virus I didn't have????

Thanks, again.

[loophole]

Hello Aslion

Good work .That looks much better. Now lets keep plugging away. I have never used AOL spyware detection. there should be an option to delete backups in the program, please do this.

Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.Don't run it yet

Please print these directions out.

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Navigate to C:\WINDOWS\Prefetch using windows explorer and delete everything in the prefetch folder , *note* do not delete the prefetch folder just what is in the folder

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [Eqy3T8tFy] C:\windows\system32\Eqy3T8tFy.exe
O4 - HKLM\..\Run: [criq.exe] C:\WINDOWS\system32\criq.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [addzm.exe] C:\WINDOWS\system32\addzm.exe
O4 - HKLM\..\Run: [addty.exe] C:\WINDOWS\system32\addty.exe
O4 - HKLM\..\Run: [7bjiq3os] C:\WINDOWS\System32\7bjiq3os.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Hqsyiz.exe
O4 - HKLM\..\Run: [javawb32.exe] C:\WINDOWS\system32\javawb32.exe
O4 - HKLM\..\Run: [javams.exe] C:\WINDOWS\system32\javams.exe
O4 - HKLM\..\Run: [javalr.exe] C:\WINDOWS\system32\javalr.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [ftjukg] c:\windows\system32\nhgbbr.exe r
O4 - HKLM\..\RunServices: [LSASS Authority] lshosts32.exe
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKCU\..\Run: [kkof] C:\PROGRA~1\COMMON~1\kkof\kkofm.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Local runole service] C:\WINDOWS\System32\srvc32.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai....r31/brix6ie.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.co...ysb_1002245.cab

Now close all windows other than HiJackThis, then click Fix Checked

Please uninstall the following (click start||control panel||add/remove programs) If present
AutoUpdate

Using windows explorer( right click start, left click explore)
Search for and delete these files and folders (some of these may not be present just continue)
C:\windows\system32\Eqy3T8tFy.exe
C:\WINDOWS\system32\criq.exe
C:\WINDOWS\system32\addzm.exe
C:\WINDOWS\system32\addty.exe
C:\WINDOWS\System32\7bjiq3os.exe
C:\WINDOWS\System32\Hqsyiz.exe
C:\WINDOWS\system32\javawb32.exe
C:\WINDOWS\system32\javams.exe
C:\WINDOWS\system32\javalr.exe
C:\WINDOWS\dinst.exe
C:\WINDOWS\System32\spoolsrv32.exe
C:\WINDOWS\System32\srvc32.exe


Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Reboot and run this online virus scan:
ActiveScan

Copy the results of the ActiveScan and paste them here with a new hijack log

Thanks

[Aslion]

smitRem log file
version 2.3

by noahdfear

The current date is: Tue 08/09/2005
The current time is: 19:45:08.84

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Wininet.dll ~~~

CLEAN!

[Aslion]

Logfile of HijackThis v1.99.1
Scan saved at 11:44:08 PM, on 8/9/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Egnsxs.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QAGENT] C:\PROGRAM FILES\QUICKENW\QAGENT.EXE
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [LSASS Authority] lshosts32.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1122598433\EE\AOLHostManager.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Internet Explorer\PLUGINS\Npswf16.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.co...m-ob-assets.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...s/yinst0401.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1101077960607
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O16 - DPF: {9F9D2D68-4980-4763-B769-510A30F2C7BC} (SvrWrapperCtl Control) - https://targetreward...rWrapperCtl.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mouse Movement Monitor (mousemm) - Unknown owner - C:\WINDOWS\System32\mousemm.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



----------------------------------------------------------

I couldn't get the ActiveScan to run, so I haven't been able to post that log.

Also, as an update, I still do not have a desktop or start button.

Thanks, again.

[loophole]

Hello

Your log looks alot better This is going better than I thought.

Please run an on-line virus scan at Kaspersky OnLine Scan post the results of the scan and a new hijack log. We will get your desktop back . Please tell me what is on your desktop presently also As far as warnings and color or messages

Thanks

[Aslion]

Logfile of HijackThis v1.99.1
Scan saved at 6:01:14 AM, on 8/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Egnsxs.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QAGENT] C:\PROGRAM FILES\QUICKENW\QAGENT.EXE
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [LSASS Authority] lshosts32.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1122598433\EE\AOLHostManager.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Internet Explorer\PLUGINS\Npswf16.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.co...m-ob-assets.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...s/yinst0401.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1101077960607
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O16 - DPF: {9F9D2D68-4980-4763-B769-510A30F2C7BC} (SvrWrapperCtl Control) - https://targetreward...rWrapperCtl.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mouse Movement Monitor (mousemm) - Unknown owner - C:\WINDOWS\System32\mousemm.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



I tried to run the Kaspersky virus scan a couple of times, and got nothing as far as a log. sorry.

[Aslion]

As far as the desktop goes, there is a photograph that we have used as wallpaper which is there (although it was blue for awhile yesterday after the smitRem. There are no warnings or messages.
Thanks, again.

[loophole]

hey Aslion

I'm sorry,I should have made myself more clear do you have your start button back and is your desktop back to normal

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Egnsxs.exe
O4 - HKLM\..\Run: [LSASS Authority] lshosts32.exe
O9 - Extra button: (no name) - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O9 - Extra 'Tools' menuitem: Search the Internet - {307D80B7-6553-42FB-9C99-19841353B4F0} - http://www.searchalot.com (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=


Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.



Please delete these files using Windows Explorer(if present):
C:\WINDOWS\System32\mousemm.exe
C:\WINDOWS\System32\Egnsxs.exe
lshosts32.exe<<<<<< search for this one (should be in the C:\WINDOWS\System32 directory)


Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the below service:


Mouse Movement Monitor (mousemm)


When you find them, double-click on each one. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok.

Run HiJackThis. Click on "None of the above, just start the program". Now, click on the "Config" button (bottom right), then click on "Misc Tools", then click on "Delete an NT Service" a window will pop up. Enter the below item into that field :

mousemm


Click ok.

It should pull up information about the service, when it asks if you want to reboot now click YES.

After that, [b]Reboot.


post a new Hijack log and tell me how your system is running


Thanks

Edited by loophole, 10 August 2005 - 05:07 PM.