Ok, it took about an hour for the Ewido scan, but here is the log (the HJT file follows it) I notice that the Ukraine is back in HJT:
EWIDO:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 9:06:59 PM, 8/8/2005
+ Report-Checksum: FA71D8DE
+ Scan result:
C:\Documents and Settings\lawcrossing\Cookies\lawcrossing@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\lawcrossing@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\lawcrossing@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\lawcrossing\Cookies\
[email protected][1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP184\A0007745.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP184\A0007747.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP184\A0007749.exe -> TrojanDropper.Agent.qb : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP184\A0007753.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP184\A0007756.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP184\A0007757.exe -> TrojanDropper.Agent.qb : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP186\A0007764.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP186\A0007765.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP186\A0007768.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP186\A0007772.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP186\A0007773.exe -> TrojanDropper.Agent.qb : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP186\A0007779.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP186\A0007780.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007791.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007796.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007800.exe -> TrojanDropper.Agent.qb : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007802.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007807.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007808.exe -> TrojanDropper.Agent.qb : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007811.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007812.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007814.dll -> Spyware.Hijacker.Generic : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007815.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP187\A0007816.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007876.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007877.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007880.exe -> TrojanDropper.Agent.qb : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007881.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007898.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007899.dll -> Spyware.SBSoft : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007912.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007916.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007918.exe -> TrojanDropper.Agent.qb : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007923.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007927.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007930.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007932.exe -> TrojanDropper.Agent.qb : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007938.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007939.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007947.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007950.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007953.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP188\A0007954.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP189\A0007975.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP189\A0007979.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP189\A0007982.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP189\A0007983.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP192\A0008031.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP192\A0008056.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP192\A0008069.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP192\A0008070.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP193\A0008084.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP193\A0008087.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP193\A0008090.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP193\A0008091.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP194\A0008096.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP194\A0008099.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP194\A0008102.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP194\A0008103.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP194\A0009096.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP194\A0009101.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP194\A0009104.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP195\A0009111.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP195\A0009114.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP195\A0009117.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP195\A0009120.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP195\A0009122.dll -> Spyware.SBSoft : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP195\A0009127.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP195\A0009130.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP195\A0009135.dll -> Spyware.SBSoft : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP196\A0009139.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP196\A0009140.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP196\A0009144.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP196\A0009146.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP196\A0009153.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP196\A0009154.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP197\A0009170.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP197\A0009172.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP197\A0009175.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP197\A0009176.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP198\A0009200.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP198\A0009204.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP198\A0009207.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP198\A0009208.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP201\A0009247.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP201\A0009250.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP202\A0009252.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP202\A0009253.exe -> Spyware.Msnagent : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP202\A0009259.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\System Volume Information\_restore{F56442AA-F748-4D4E-8590-BF0504DF99D6}\RP202\A0009262.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\WINDOWS\system32\dmxqt.exe -> TrojanDropper.Vidro.u : Cleaned with backup
C:\WINDOWS\tmp.hta -> TrojanDownloader.VBS.Psyme.at : Cleaned with backup
::Report End
NOW HIJACK THIS:
Logfile of HijackThis v1.99.1
Scan saved at 9:07:58 PM, on 8/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Movie Magic Screenwriter\scwriter32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Documents and Settings\lawcrossing\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: (no name) - -{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - -{53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - -{AE7CD045-E861-484F-8273-0445EE161910} - (no file)
O3 - Toolbar: (no name) - -{47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chess -
http://download.game...nts/y/ct2_x.cabO16 - DPF: Yahoo! Pool 2 -
http://download.game...ts/y/pote_x.cabO16 - DPF: {5A447319-0EA2-447B-A063-A5F849B097D0} (ScanZillaLE Class) -
https://www2.stopzil...es/SZScanLE.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
http://messenger.msn...pDownloader.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{F368DA97-ED4C-4C36-B4F3-6D6C01F30CC5}: NameServer = 195.95.218.1 85.255.112.7
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\lawcrossing\Desktop\CWShredder.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe