[SilentX]

********
1:37 AM: |··· Start of Session, Wednesday, August 31, 2005 ···|
1:37 AM: Spy Sweeper started
1:37 AM: Sweep initiated using definitions version 524
1:37 AM: Starting Memory Sweep
1:38 AM: Memory Sweep Complete, Elapsed Time: 00:01:40
1:38 AM: Starting Registry Sweep
1:38 AM: Found Adware: begin2search
1:38 AM: HKCR\btnetw.amo.1\ (3 subtraces) (ID = 104095)
1:38 AM: HKCR\btnetw.amo\ (5 subtraces) (ID = 104096)
1:38 AM: Found Adware: hotsearchbar toolbar
1:38 AM: HKCR\btnetw.amo\ (5 subtraces) (ID = 104096)
1:38 AM: HKCR\btnetw.iiittt.1\ (3 subtraces) (ID = 104097)
1:38 AM: HKCR\btnetw.iiittt\ (5 subtraces) (ID = 104098)
1:38 AM: HKCR\btnetw.iiittt\ (5 subtraces) (ID = 104098)
1:38 AM: HKCR\btnetw.momo.1\ (3 subtraces) (ID = 104099)
1:38 AM: HKCR\btnetw.momo\ (5 subtraces) (ID = 104100)
1:38 AM: HKCR\btnetw.momo\ (5 subtraces) (ID = 104100)
1:38 AM: HKCR\btnetw.ohb.1\ (3 subtraces) (ID = 104101)
1:38 AM: HKCR\btnetw.ohb\ (5 subtraces) (ID = 104102)
1:38 AM: HKCR\btnetw.ohb\ (5 subtraces) (ID = 104102)
1:38 AM: HKCR\clsid\{bc54b24c-5a97-4c19-9181-8b8a05b2e931}\ (11 subtraces) (ID = 104118)
1:38 AM: HKCR\clsid\{bc54b24c-5a97-4c19-9181-8b8a05b2e931}\ (11 subtraces) (ID = 104118)
1:38 AM: HKCR\clsid\{bd9584ef-c28c-4f6d-8d49-0cee3c0e442f}\ (22 subtraces) (ID = 104119)
1:38 AM: HKCR\clsid\{bd9584ef-c28c-4f6d-8d49-0cee3c0e442f}\ (22 subtraces) (ID = 104119)
1:38 AM: HKCR\clsid\{c7888681-1a83-4c14-b9a5-95f91240b44f}\ (11 subtraces) (ID = 104120)
1:38 AM: HKCR\clsid\{c7888681-1a83-4c14-b9a5-95f91240b44f}\ (11 subtraces) (ID = 104120)
1:38 AM: HKCR\interface\{6b882c34-a832-4f5b-bef1-7e198be3f094}\ (8 subtraces) (ID = 104124)
1:38 AM: HKCR\interface\{9b6b4031-1d6d-4c65-acba-021916853822}\ (8 subtraces) (ID = 104126)
1:38 AM: HKCR\interface\{9ff60a27-0c0c-4a6a-a15f-b21b644d67bb}\ (8 subtraces) (ID = 104127)
1:38 AM: HKCR\interface\{15d53b86-e055-43b1-bbee-a91a0f37bd2a}\ (8 subtraces) (ID = 104128)
1:38 AM: HKCR\interface\{f3c41c1d-22f1-4692-8a7a-88de70a2e9e2}\ (8 subtraces) (ID = 104139)
1:38 AM: HKCR\interface\{fa6fa7a5-2c49-4567-ba74-6dd1c36099ee}\ (8 subtraces) (ID = 104141)
1:38 AM: HKLM\software\classes\btnetw.amo.1\ (3 subtraces) (ID = 104145)
1:38 AM: HKLM\software\classes\btnetw.amo\ (5 subtraces) (ID = 104146)
1:38 AM: HKLM\software\classes\btnetw.amo\ (5 subtraces) (ID = 104146)
1:38 AM: HKLM\software\classes\btnetw.iiittt.1\ (3 subtraces) (ID = 104147)
1:38 AM: HKLM\software\classes\btnetw.iiittt\ (5 subtraces) (ID = 104148)
1:38 AM: HKLM\software\classes\btnetw.iiittt\ (5 subtraces) (ID = 104148)
1:38 AM: HKLM\software\classes\btnetw.momo.1\ (3 subtraces) (ID = 104149)
1:38 AM: HKLM\software\classes\btnetw.momo\ (5 subtraces) (ID = 104150)
1:38 AM: HKLM\software\classes\btnetw.momo\ (5 subtraces) (ID = 104150)
1:38 AM: HKLM\software\classes\btnetw.ohb.1\ (3 subtraces) (ID = 104151)
1:38 AM: HKLM\software\classes\btnetw.ohb\ (5 subtraces) (ID = 104152)
1:38 AM: HKLM\software\classes\btnetw.ohb\ (5 subtraces) (ID = 104152)
1:38 AM: HKLM\software\classes\clsid\{bc54b24c-5a97-4c19-9181-8b8a05b2e931}\ (11 subtraces) (ID = 104168)
1:38 AM: HKLM\software\classes\clsid\{bc54b24c-5a97-4c19-9181-8b8a05b2e931}\ (11 subtraces) (ID = 104168)
1:38 AM: HKLM\software\classes\clsid\{bd9584ef-c28c-4f6d-8d49-0cee3c0e442f}\ (22 subtraces) (ID = 104169)
1:38 AM: HKLM\software\classes\clsid\{bd9584ef-c28c-4f6d-8d49-0cee3c0e442f}\ (22 subtraces) (ID = 104169)
1:38 AM: HKLM\software\classes\clsid\{c7888681-1a83-4c14-b9a5-95f91240b44f}\ (11 subtraces) (ID = 104170)
1:38 AM: HKLM\software\classes\clsid\{c7888681-1a83-4c14-b9a5-95f91240b44f}\ (11 subtraces) (ID = 104170)
1:38 AM: HKLM\software\classes\interface\{6b882c34-a832-4f5b-bef1-7e198be3f094}\ (8 subtraces) (ID = 104174)
1:38 AM: HKLM\software\classes\interface\{9b6b4031-1d6d-4c65-acba-021916853822}\ (8 subtraces) (ID = 104176)
1:38 AM: HKLM\software\classes\interface\{9ff60a27-0c0c-4a6a-a15f-b21b644d67bb}\ (8 subtraces) (ID = 104177)
1:38 AM: HKLM\software\classes\interface\{15d53b86-e055-43b1-bbee-a91a0f37bd2a}\ (8 subtraces) (ID = 104178)
1:38 AM: HKLM\software\classes\interface\{f3c41c1d-22f1-4692-8a7a-88de70a2e9e2}\ (8 subtraces) (ID = 104189)
1:38 AM: HKLM\software\classes\interface\{fa6fa7a5-2c49-4567-ba74-6dd1c36099ee}\ (8 subtraces) (ID = 104191)
1:38 AM: HKLM\software\classes\typelib\{bf56be6a-0aea-45f3-8b10-7312876584a8}\ (9 subtraces) (ID = 104195)
1:38 AM: HKLM\software\classes\typelib\{bf56be6a-0aea-45f3-8b10-7312876584a8}\ (9 subtraces) (ID = 104195)
1:38 AM: HKCR\typelib\{bf56be6a-0aea-45f3-8b10-7312876584a8}\ (9 subtraces) (ID = 104238)
1:38 AM: HKCR\typelib\{bf56be6a-0aea-45f3-8b10-7312876584a8}\ (9 subtraces) (ID = 104238)
1:38 AM: Found Adware: cas
1:38 AM: HKCR\clsid\{8293d547-38dd-4325-b35a-f1817edfa5fc}\ (11 subtraces) (ID = 105365)
1:38 AM: HKCR\typelib\{d4c89c18-b4f3-46a9-8800-e9e7a55afbd9}\ (9 subtraces) (ID = 105366)
1:38 AM: HKLM\software\classes\clsid\{8293d547-38dd-4325-b35a-f1817edfa5fc}\ (11 subtraces) (ID = 105368)
1:38 AM: HKLM\software\classes\typelib\{d4c89c18-b4f3-46a9-8800-e9e7a55afbd9}\ (9 subtraces) (ID = 105369)
1:38 AM: Found Adware: drsnsrch.com hijack
1:38 AM: HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\microsoft\search assistant\ || defaultsearchurl (ID = 128205)
1:39 AM: Found Adware: visfx
1:39 AM: HKLM\system\currentcontrolset\services\windows visfx components\ (12 subtraces) (ID = 145735)
1:39 AM: Found Adware: abetterinternet
1:39 AM: HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\aurora\ (18 subtraces) (ID = 360174)
1:39 AM: HKU\WRSS_Profile_S-1-5-21-2403904371-3563561673-3378400465-500\software\aurora\ (18 subtraces) (ID = 360174)
1:39 AM: HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\cmapp\ (12 subtraces) (ID = 381792)
1:39 AM: Found Trojan Horse: sysnet
1:39 AM: HKLM\software\microsoft\windows\currentversion\uninstall\sysnet\ (2 subtraces) (ID = 381857)
1:39 AM: HKCR\main.mimefilter\ (5 subtraces) (ID = 498504)
1:39 AM: HKLM\software\classes\main.mimefilter\ (5 subtraces) (ID = 498516)
1:39 AM: HKCR\main.mimefilter\ (5 subtraces) (ID = 499294)
1:39 AM: HKLM\software\classes\main.mimefilter\ (5 subtraces) (ID = 499295)
1:39 AM: Found Adware: drsnsrch hijacker
1:39 AM: HKCR\dsrch.band\ (5 subtraces) (ID = 509134)
1:39 AM: HKCR\typelib\{8f73ac0f-5769-4282-8762-b396a3bff377}\ (9 subtraces) (ID = 509153)
1:39 AM: HKLM\software\classes\dsrch.band\ (5 subtraces) (ID = 509171)
1:39 AM: HKCR\dsrch.band\clsid\ (1 subtraces) (ID = 509361)
1:39 AM: HKCR\dsrch.band\curver\ (1 subtraces) (ID = 509362)
1:39 AM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{00f1d395-4744-40f0-a611-980f61ae2c59}\ (ID = 513230)
1:39 AM: Found Adware: rich editor
1:39 AM: HKCR\typelib\{34a35bbb-8c19-4482-864c-290bd8dd6a5d}\ (9 subtraces) (ID = 544913)
1:39 AM: HKLM\software\microsoft\windows\currentversion\app paths\lanbrd\ (2 subtraces) (ID = 550562)
1:39 AM: HKLM\software\microsoft\windows\currentversion\app paths\lanbrup\ (2 subtraces) (ID = 550565)
1:39 AM: HKLM\software\classes\typelib\{34a35bbb-8c19-4482-864c-290bd8dd6a5d}\ (9 subtraces) (ID = 550573)
1:39 AM: HKLM\system\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\lanbrup.exe\ (1 subtraces) (ID = 552678)
1:39 AM: HKCR\pool.lanbridge\ (5 subtraces) (ID = 608249)
1:39 AM: HKLM\software\classes\pool.lanbridge\ (5 subtraces) (ID = 609138)
1:39 AM: HKLM\software\classes\typelib\{34a35bbb-8c19-4482-864c-290bd8dd6a5d}\1.0\ (8 subtraces) (ID = 609169)
1:39 AM: HKLM\software\lanbridge\ (34 subtraces) (ID = 609177)
1:39 AM: HKLM\software\microsoft\windows\currentversion\uninstall\lanbridge\ (2 subtraces) (ID = 609194)
1:39 AM: HKCR\main.mimefilter.1\ (3 subtraces) (ID = 609377)
1:39 AM: HKCR\appid\{e0dc5cc4-25a5-4bc7-a3aa-3525733dc796}\ (1 subtraces) (ID = 609381)
1:39 AM: HKLM\software\classes\appid\{e0dc5cc4-25a5-4bc7-a3aa-3525733dc796}\ (1 subtraces) (ID = 609547)
1:39 AM: HKLM\software\classes\typelib\{8f73ac0f-5769-4282-8762-b396a3bff377}\ (9 subtraces) (ID = 646384)
1:39 AM: HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\cmapp\client\ || registered (ID = 724012)
1:39 AM: HKLM\software\classes\clsid\{8293d547-38dd-4325-b35a-f1817edfa5fc}\progid\ (1 subtraces) (ID = 724042)
1:39 AM: Registry Sweep Complete, Elapsed Time:00:00:09
1:39 AM: Starting Cookie Sweep
1:39 AM: Found Spy Cookie: adknowledge cookie
1:39 AM: owner@adknowledge[2].txt (ID = 2072)
1:39 AM: Found Spy Cookie: adlegend cookie
1:39 AM: owner@adlegend[1].txt (ID = 2074)
1:39 AM: Found Spy Cookie: adrevolver cookie
1:39 AM: owner@adrevolver[1].txt (ID = 2088)
1:39 AM: owner@adrevolver[3].txt (ID = 2088)
1:39 AM: Found Spy Cookie: cc214142 cookie
1:39 AM: [email protected][1].txt (ID = 2367)
1:39 AM: Found Spy Cookie: pointroll cookie
1:39 AM: [email protected][2].txt (ID = 3148)
1:39 AM: Found Spy Cookie: advertising cookie
1:39 AM: owner@advertising[1].txt (ID = 2175)
1:39 AM: Found Spy Cookie: atwola cookie
1:39 AM: [email protected][1].txt (ID = 2256)
1:39 AM: Found Spy Cookie: ask cookie
1:39 AM: owner@ask[1].txt (ID = 2245)
1:39 AM: Found Spy Cookie: atlas dmt cookie
1:39 AM: owner@atdmt[2].txt (ID = 2253)
1:39 AM: Found Spy Cookie: belnk cookie
1:39 AM: [email protected][2].txt (ID = 2293)
1:39 AM: owner@atwola[1].txt (ID = 2255)
1:39 AM: Found Spy Cookie: banner cookie
1:39 AM: owner@banner[1].txt (ID = 2276)
1:39 AM: owner@belnk[2].txt (ID = 2292)
1:39 AM: [email protected][2].txt (ID = 2293)
1:39 AM: Found Spy Cookie: questionmarket cookie
1:39 AM: owner@questionmarket[1].txt (ID = 3217)
1:39 AM: Found Spy Cookie: realmedia cookie
1:39 AM: owner@realmedia[1].txt (ID = 3235)
1:39 AM: Found Spy Cookie: servedby advertising cookie
1:39 AM: [email protected][1].txt (ID = 3335)
1:39 AM: Cookie Sweep Complete, Elapsed Time: 00:00:01
1:39 AM: Starting File Sweep
1:39 AM: c:\program files\asys (1 subtraces) (ID = -2147477847)
1:39 AM: c:\program files\epicenter (1 subtraces) (ID = -2147477846)
1:39 AM: Warning: Failed to read file "c:\windows\afotenc.exe". System Error. Code: 5.
Access is denied
1:39 AM: Found Trojan Horse: trojan downloader pops-stop
1:39 AM: installerv4.exe (ID = 122359)
1:39 AM: lanbruns.exe (ID = 122360)
1:39 AM: Found Adware: shopathomeselect
1:39 AM: hp9ct9o5.dat (ID = 121494)
1:40 AM: vxfo2.exe (ID = 133280)
1:40 AM: Warning: Failed to read file "c:\windows\moqcenc.exe". System Error. Code: 5.
Access is denied
1:40 AM: snuninst.exe (ID = 110129)
1:40 AM: vfx8.0-1.exe (ID = 110122)
1:40 AM: Warning: Failed to read file "c:\windows\afnxenc.exe". System Error. Code: 5.
Access is denied
1:42 AM: wirelanb.dll (ID = 125490)
1:42 AM: vwmwsvc.exe (ID = 133415)
1:42 AM: File Sweep Complete, Elapsed Time: 00:03:19
1:42 AM: Full Sweep has completed. Elapsed time 00:05:10
1:42 AM: Traces Found: 765
1:42 AM: Removal process initiated
1:42 AM: Quarantining All Traces: begin2search
1:42 AM: Quarantining All Traces: hotsearchbar toolbar
1:42 AM: Quarantining All Traces: cas
1:42 AM: Quarantining All Traces: drsnsrch.com hijack
1:42 AM: Quarantining All Traces: visfx
1:43 AM: Quarantining All Traces: abetterinternet
1:43 AM: Quarantining All Traces: sysnet
1:43 AM: Quarantining All Traces: drsnsrch hijacker
1:43 AM: Quarantining All Traces: rich editor
1:43 AM: Quarantining All Traces: adknowledge cookie
1:43 AM: Quarantining All Traces: adlegend cookie
1:43 AM: Quarantining All Traces: adrevolver cookie
1:43 AM: Quarantining All Traces: cc214142 cookie
1:43 AM: Quarantining All Traces: pointroll cookie
1:43 AM: Quarantining All Traces: advertising cookie
1:43 AM: Quarantining All Traces: atwola cookie
1:43 AM: Quarantining All Traces: ask cookie
1:43 AM: Quarantining All Traces: atlas dmt cookie
1:43 AM: Quarantining All Traces: belnk cookie
1:43 AM: Quarantining All Traces: banner cookie
1:43 AM: Quarantining All Traces: questionmarket cookie
1:43 AM: Quarantining All Traces: realmedia cookie
1:43 AM: Quarantining All Traces: servedby advertising cookie
1:43 AM: Quarantining All Traces: trojan downloader pops-stop
1:43 AM: Quarantining All Traces: shopathomeselect
1:43 AM: Warning: Quarantine could not read registry value for HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\cmapp\client\registered\. Failed to export registry value "S-1-5-21-2403904371-3563561673-3378400465-1003\software\cmapp\client\registered". Key/Value does not exist
1:43 AM: Removal process completed. Elapsed time 00:01:02
********
1:36 AM: |··· Start of Session, Wednesday, August 31, 2005 ···|
1:36 AM: Spy Sweeper started
1:37 AM: |··· End of Session, Wednesday, August 31, 2005 ···|

[Advertisements]

Open up Killbox.

• Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:
  • 
    c:\WINDOWS\afnxenc.exe
    c:\WINDOWS\afotenc.exe
    c:\WINDOWS\moqcenc.exe
    
    
• Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
• Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

Your system will reboot now.



Poke around a bit and let me know if AVG finds anything now. Also run another scan with Spysweeper and post the log in your next reply.

Edited by Buckeye_Sam, 31 August 2005 - 03:41 PM.

[Buckeye_Sam]

Open up Killbox.

• Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:
  • 
    c:\WINDOWS\afnxenc.exe
    c:\WINDOWS\afotenc.exe
    c:\WINDOWS\moqcenc.exe
    
    
• Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
• Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

Your system will reboot now.



Poke around a bit and let me know if AVG finds anything now. Also run another scan with Spysweeper and post the log in your next reply.

Edited by Buckeye_Sam, 31 August 2005 - 03:41 PM.

[SilentX]

It looks like the WINDOWS folder is clean right now. If nothing is wrong with this spysweeper report, do you mind keeping the topic open for a few days in case I find another problem?



********
1:14 AM: |··· Start of Session, Thursday, September 01, 2005 ···|
1:14 AM: Spy Sweeper started
1:14 AM: Sweep initiated using definitions version 524
1:14 AM: Starting Memory Sweep
1:16 AM: Memory Sweep Complete, Elapsed Time: 00:01:33
1:16 AM: Starting Registry Sweep
1:16 AM: Registry Sweep Complete, Elapsed Time:00:00:06
1:16 AM: Starting Cookie Sweep
1:16 AM: Found Spy Cookie: advertising cookie
1:16 AM: owner@advertising[1].txt (ID = 2175)
1:16 AM: Found Spy Cookie: maxserving cookie
1:16 AM: owner@maxserving[1].txt (ID = 2966)
1:16 AM: Found Spy Cookie: servedby advertising cookie
1:16 AM: [email protected][1].txt (ID = 3335)
1:16 AM: Cookie Sweep Complete, Elapsed Time: 00:00:00
1:16 AM: Starting File Sweep
1:19 AM: File Sweep Complete, Elapsed Time: 00:03:07
1:19 AM: Full Sweep has completed. Elapsed time 00:04:49
1:19 AM: Traces Found: 3
1:20 AM: Removal process initiated
1:20 AM: Quarantining All Traces: advertising cookie
1:20 AM: Quarantining All Traces: maxserving cookie
1:20 AM: Quarantining All Traces: servedby advertising cookie
1:20 AM: Removal process completed. Elapsed time 00:00:01
********
1:37 AM: |··· Start of Session, Wednesday, August 31, 2005 ···|
1:37 AM: Spy Sweeper started
1:37 AM: Sweep initiated using definitions version 524
1:37 AM: Starting Memory Sweep
1:38 AM: Memory Sweep Complete, Elapsed Time: 00:01:40
1:38 AM: Starting Registry Sweep
1:38 AM: Found Adware: begin2search
1:38 AM: HKCR\btnetw.amo.1\ (3 subtraces) (ID = 104095)
1:38 AM: HKCR\btnetw.amo\ (5 subtraces) (ID = 104096)
1:38 AM: Found Adware: hotsearchbar toolbar
1:38 AM: HKCR\btnetw.amo\ (5 subtraces) (ID = 104096)
1:38 AM: HKCR\btnetw.iiittt.1\ (3 subtraces) (ID = 104097)
1:38 AM: HKCR\btnetw.iiittt\ (5 subtraces) (ID = 104098)
1:38 AM: HKCR\btnetw.iiittt\ (5 subtraces) (ID = 104098)
1:38 AM: HKCR\btnetw.momo.1\ (3 subtraces) (ID = 104099)
1:38 AM: HKCR\btnetw.momo\ (5 subtraces) (ID = 104100)
1:38 AM: HKCR\btnetw.momo\ (5 subtraces) (ID = 104100)
1:38 AM: HKCR\btnetw.ohb.1\ (3 subtraces) (ID = 104101)
1:38 AM: HKCR\btnetw.ohb\ (5 subtraces) (ID = 104102)
1:38 AM: HKCR\btnetw.ohb\ (5 subtraces) (ID = 104102)
1:38 AM: HKCR\clsid\{bc54b24c-5a97-4c19-9181-8b8a05b2e931}\ (11 subtraces) (ID = 104118)
1:38 AM: HKCR\clsid\{bc54b24c-5a97-4c19-9181-8b8a05b2e931}\ (11 subtraces) (ID = 104118)
1:38 AM: HKCR\clsid\{bd9584ef-c28c-4f6d-8d49-0cee3c0e442f}\ (22 subtraces) (ID = 104119)
1:38 AM: HKCR\clsid\{bd9584ef-c28c-4f6d-8d49-0cee3c0e442f}\ (22 subtraces) (ID = 104119)
1:38 AM: HKCR\clsid\{c7888681-1a83-4c14-b9a5-95f91240b44f}\ (11 subtraces) (ID = 104120)
1:38 AM: HKCR\clsid\{c7888681-1a83-4c14-b9a5-95f91240b44f}\ (11 subtraces) (ID = 104120)
1:38 AM: HKCR\interface\{6b882c34-a832-4f5b-bef1-7e198be3f094}\ (8 subtraces) (ID = 104124)
1:38 AM: HKCR\interface\{9b6b4031-1d6d-4c65-acba-021916853822}\ (8 subtraces) (ID = 104126)
1:38 AM: HKCR\interface\{9ff60a27-0c0c-4a6a-a15f-b21b644d67bb}\ (8 subtraces) (ID = 104127)
1:38 AM: HKCR\interface\{15d53b86-e055-43b1-bbee-a91a0f37bd2a}\ (8 subtraces) (ID = 104128)
1:38 AM: HKCR\interface\{f3c41c1d-22f1-4692-8a7a-88de70a2e9e2}\ (8 subtraces) (ID = 104139)
1:38 AM: HKCR\interface\{fa6fa7a5-2c49-4567-ba74-6dd1c36099ee}\ (8 subtraces) (ID = 104141)
1:38 AM: HKLM\software\classes\btnetw.amo.1\ (3 subtraces) (ID = 104145)
1:38 AM: HKLM\software\classes\btnetw.amo\ (5 subtraces) (ID = 104146)
1:38 AM: HKLM\software\classes\btnetw.amo\ (5 subtraces) (ID = 104146)
1:38 AM: HKLM\software\classes\btnetw.iiittt.1\ (3 subtraces) (ID = 104147)
1:38 AM: HKLM\software\classes\btnetw.iiittt\ (5 subtraces) (ID = 104148)
1:38 AM: HKLM\software\classes\btnetw.iiittt\ (5 subtraces) (ID = 104148)
1:38 AM: HKLM\software\classes\btnetw.momo.1\ (3 subtraces) (ID = 104149)
1:38 AM: HKLM\software\classes\btnetw.momo\ (5 subtraces) (ID = 104150)
1:38 AM: HKLM\software\classes\btnetw.momo\ (5 subtraces) (ID = 104150)
1:38 AM: HKLM\software\classes\btnetw.ohb.1\ (3 subtraces) (ID = 104151)
1:38 AM: HKLM\software\classes\btnetw.ohb\ (5 subtraces) (ID = 104152)
1:38 AM: HKLM\software\classes\btnetw.ohb\ (5 subtraces) (ID = 104152)
1:38 AM: HKLM\software\classes\clsid\{bc54b24c-5a97-4c19-9181-8b8a05b2e931}\ (11 subtraces) (ID = 104168)
1:38 AM: HKLM\software\classes\clsid\{bc54b24c-5a97-4c19-9181-8b8a05b2e931}\ (11 subtraces) (ID = 104168)
1:38 AM: HKLM\software\classes\clsid\{bd9584ef-c28c-4f6d-8d49-0cee3c0e442f}\ (22 subtraces) (ID = 104169)
1:38 AM: HKLM\software\classes\clsid\{bd9584ef-c28c-4f6d-8d49-0cee3c0e442f}\ (22 subtraces) (ID = 104169)
1:38 AM: HKLM\software\classes\clsid\{c7888681-1a83-4c14-b9a5-95f91240b44f}\ (11 subtraces) (ID = 104170)
1:38 AM: HKLM\software\classes\clsid\{c7888681-1a83-4c14-b9a5-95f91240b44f}\ (11 subtraces) (ID = 104170)
1:38 AM: HKLM\software\classes\interface\{6b882c34-a832-4f5b-bef1-7e198be3f094}\ (8 subtraces) (ID = 104174)
1:38 AM: HKLM\software\classes\interface\{9b6b4031-1d6d-4c65-acba-021916853822}\ (8 subtraces) (ID = 104176)
1:38 AM: HKLM\software\classes\interface\{9ff60a27-0c0c-4a6a-a15f-b21b644d67bb}\ (8 subtraces) (ID = 104177)
1:38 AM: HKLM\software\classes\interface\{15d53b86-e055-43b1-bbee-a91a0f37bd2a}\ (8 subtraces) (ID = 104178)
1:38 AM: HKLM\software\classes\interface\{f3c41c1d-22f1-4692-8a7a-88de70a2e9e2}\ (8 subtraces) (ID = 104189)
1:38 AM: HKLM\software\classes\interface\{fa6fa7a5-2c49-4567-ba74-6dd1c36099ee}\ (8 subtraces) (ID = 104191)
1:38 AM: HKLM\software\classes\typelib\{bf56be6a-0aea-45f3-8b10-7312876584a8}\ (9 subtraces) (ID = 104195)
1:38 AM: HKLM\software\classes\typelib\{bf56be6a-0aea-45f3-8b10-7312876584a8}\ (9 subtraces) (ID = 104195)
1:38 AM: HKCR\typelib\{bf56be6a-0aea-45f3-8b10-7312876584a8}\ (9 subtraces) (ID = 104238)
1:38 AM: HKCR\typelib\{bf56be6a-0aea-45f3-8b10-7312876584a8}\ (9 subtraces) (ID = 104238)
1:38 AM: Found Adware: cas
1:38 AM: HKCR\clsid\{8293d547-38dd-4325-b35a-f1817edfa5fc}\ (11 subtraces) (ID = 105365)
1:38 AM: HKCR\typelib\{d4c89c18-b4f3-46a9-8800-e9e7a55afbd9}\ (9 subtraces) (ID = 105366)
1:38 AM: HKLM\software\classes\clsid\{8293d547-38dd-4325-b35a-f1817edfa5fc}\ (11 subtraces) (ID = 105368)
1:38 AM: HKLM\software\classes\typelib\{d4c89c18-b4f3-46a9-8800-e9e7a55afbd9}\ (9 subtraces) (ID = 105369)
1:38 AM: Found Adware: drsnsrch.com hijack
1:38 AM: HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\microsoft\search assistant\ || defaultsearchurl (ID = 128205)
1:39 AM: Found Adware: visfx
1:39 AM: HKLM\system\currentcontrolset\services\windows visfx components\ (12 subtraces) (ID = 145735)
1:39 AM: Found Adware: abetterinternet
1:39 AM: HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\aurora\ (18 subtraces) (ID = 360174)
1:39 AM: HKU\WRSS_Profile_S-1-5-21-2403904371-3563561673-3378400465-500\software\aurora\ (18 subtraces) (ID = 360174)
1:39 AM: HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\cmapp\ (12 subtraces) (ID = 381792)
1:39 AM: Found Trojan Horse: sysnet
1:39 AM: HKLM\software\microsoft\windows\currentversion\uninstall\sysnet\ (2 subtraces) (ID = 381857)
1:39 AM: HKCR\main.mimefilter\ (5 subtraces) (ID = 498504)
1:39 AM: HKLM\software\classes\main.mimefilter\ (5 subtraces) (ID = 498516)
1:39 AM: HKCR\main.mimefilter\ (5 subtraces) (ID = 499294)
1:39 AM: HKLM\software\classes\main.mimefilter\ (5 subtraces) (ID = 499295)
1:39 AM: Found Adware: drsnsrch hijacker
1:39 AM: HKCR\dsrch.band\ (5 subtraces) (ID = 509134)
1:39 AM: HKCR\typelib\{8f73ac0f-5769-4282-8762-b396a3bff377}\ (9 subtraces) (ID = 509153)
1:39 AM: HKLM\software\classes\dsrch.band\ (5 subtraces) (ID = 509171)
1:39 AM: HKCR\dsrch.band\clsid\ (1 subtraces) (ID = 509361)
1:39 AM: HKCR\dsrch.band\curver\ (1 subtraces) (ID = 509362)
1:39 AM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{00f1d395-4744-40f0-a611-980f61ae2c59}\ (ID = 513230)
1:39 AM: Found Adware: rich editor
1:39 AM: HKCR\typelib\{34a35bbb-8c19-4482-864c-290bd8dd6a5d}\ (9 subtraces) (ID = 544913)
1:39 AM: HKLM\software\microsoft\windows\currentversion\app paths\lanbrd\ (2 subtraces) (ID = 550562)
1:39 AM: HKLM\software\microsoft\windows\currentversion\app paths\lanbrup\ (2 subtraces) (ID = 550565)
1:39 AM: HKLM\software\classes\typelib\{34a35bbb-8c19-4482-864c-290bd8dd6a5d}\ (9 subtraces) (ID = 550573)
1:39 AM: HKLM\system\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\lanbrup.exe\ (1 subtraces) (ID = 552678)
1:39 AM: HKCR\pool.lanbridge\ (5 subtraces) (ID = 608249)
1:39 AM: HKLM\software\classes\pool.lanbridge\ (5 subtraces) (ID = 609138)
1:39 AM: HKLM\software\classes\typelib\{34a35bbb-8c19-4482-864c-290bd8dd6a5d}\1.0\ (8 subtraces) (ID = 609169)
1:39 AM: HKLM\software\lanbridge\ (34 subtraces) (ID = 609177)
1:39 AM: HKLM\software\microsoft\windows\currentversion\uninstall\lanbridge\ (2 subtraces) (ID = 609194)
1:39 AM: HKCR\main.mimefilter.1\ (3 subtraces) (ID = 609377)
1:39 AM: HKCR\appid\{e0dc5cc4-25a5-4bc7-a3aa-3525733dc796}\ (1 subtraces) (ID = 609381)
1:39 AM: HKLM\software\classes\appid\{e0dc5cc4-25a5-4bc7-a3aa-3525733dc796}\ (1 subtraces) (ID = 609547)
1:39 AM: HKLM\software\classes\typelib\{8f73ac0f-5769-4282-8762-b396a3bff377}\ (9 subtraces) (ID = 646384)
1:39 AM: HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\cmapp\client\ || registered (ID = 724012)
1:39 AM: HKLM\software\classes\clsid\{8293d547-38dd-4325-b35a-f1817edfa5fc}\progid\ (1 subtraces) (ID = 724042)
1:39 AM: Registry Sweep Complete, Elapsed Time:00:00:09
1:39 AM: Starting Cookie Sweep
1:39 AM: Found Spy Cookie: adknowledge cookie
1:39 AM: owner@adknowledge[2].txt (ID = 2072)
1:39 AM: Found Spy Cookie: adlegend cookie
1:39 AM: owner@adlegend[1].txt (ID = 2074)
1:39 AM: Found Spy Cookie: adrevolver cookie
1:39 AM: owner@adrevolver[1].txt (ID = 2088)
1:39 AM: owner@adrevolver[3].txt (ID = 2088)
1:39 AM: Found Spy Cookie: cc214142 cookie
1:39 AM: [email protected][1].txt (ID = 2367)
1:39 AM: Found Spy Cookie: pointroll cookie
1:39 AM: [email protected][2].txt (ID = 3148)
1:39 AM: Found Spy Cookie: advertising cookie
1:39 AM: owner@advertising[1].txt (ID = 2175)
1:39 AM: Found Spy Cookie: atwola cookie
1:39 AM: [email protected][1].txt (ID = 2256)
1:39 AM: Found Spy Cookie: ask cookie
1:39 AM: owner@ask[1].txt (ID = 2245)
1:39 AM: Found Spy Cookie: atlas dmt cookie
1:39 AM: owner@atdmt[2].txt (ID = 2253)
1:39 AM: Found Spy Cookie: belnk cookie
1:39 AM: [email protected][2].txt (ID = 2293)
1:39 AM: owner@atwola[1].txt (ID = 2255)
1:39 AM: Found Spy Cookie: banner cookie
1:39 AM: owner@banner[1].txt (ID = 2276)
1:39 AM: owner@belnk[2].txt (ID = 2292)
1:39 AM: [email protected][2].txt (ID = 2293)
1:39 AM: Found Spy Cookie: questionmarket cookie
1:39 AM: owner@questionmarket[1].txt (ID = 3217)
1:39 AM: Found Spy Cookie: realmedia cookie
1:39 AM: owner@realmedia[1].txt (ID = 3235)
1:39 AM: Found Spy Cookie: servedby advertising cookie
1:39 AM: [email protected][1].txt (ID = 3335)
1:39 AM: Cookie Sweep Complete, Elapsed Time: 00:00:01
1:39 AM: Starting File Sweep
1:39 AM: c:\program files\asys (1 subtraces) (ID = -2147477847)
1:39 AM: c:\program files\epicenter (1 subtraces) (ID = -2147477846)
1:39 AM: Warning: Failed to read file "c:\windows\afotenc.exe". System Error. Code: 5.
Access is denied
1:39 AM: Found Trojan Horse: trojan downloader pops-stop
1:39 AM: installerv4.exe (ID = 122359)
1:39 AM: lanbruns.exe (ID = 122360)
1:39 AM: Found Adware: shopathomeselect
1:39 AM: hp9ct9o5.dat (ID = 121494)
1:40 AM: vxfo2.exe (ID = 133280)
1:40 AM: Warning: Failed to read file "c:\windows\moqcenc.exe". System Error. Code: 5.
Access is denied
1:40 AM: snuninst.exe (ID = 110129)
1:40 AM: vfx8.0-1.exe (ID = 110122)
1:40 AM: Warning: Failed to read file "c:\windows\afnxenc.exe". System Error. Code: 5.
Access is denied
1:42 AM: wirelanb.dll (ID = 125490)
1:42 AM: vwmwsvc.exe (ID = 133415)
1:42 AM: File Sweep Complete, Elapsed Time: 00:03:19
1:42 AM: Full Sweep has completed. Elapsed time 00:05:10
1:42 AM: Traces Found: 765
1:42 AM: Removal process initiated
1:42 AM: Quarantining All Traces: begin2search
1:42 AM: Quarantining All Traces: hotsearchbar toolbar
1:42 AM: Quarantining All Traces: cas
1:42 AM: Quarantining All Traces: drsnsrch.com hijack
1:42 AM: Quarantining All Traces: visfx
1:43 AM: Quarantining All Traces: abetterinternet
1:43 AM: Quarantining All Traces: sysnet
1:43 AM: Quarantining All Traces: drsnsrch hijacker
1:43 AM: Quarantining All Traces: rich editor
1:43 AM: Quarantining All Traces: adknowledge cookie
1:43 AM: Quarantining All Traces: adlegend cookie
1:43 AM: Quarantining All Traces: adrevolver cookie
1:43 AM: Quarantining All Traces: cc214142 cookie
1:43 AM: Quarantining All Traces: pointroll cookie
1:43 AM: Quarantining All Traces: advertising cookie
1:43 AM: Quarantining All Traces: atwola cookie
1:43 AM: Quarantining All Traces: ask cookie
1:43 AM: Quarantining All Traces: atlas dmt cookie
1:43 AM: Quarantining All Traces: belnk cookie
1:43 AM: Quarantining All Traces: banner cookie
1:43 AM: Quarantining All Traces: questionmarket cookie
1:43 AM: Quarantining All Traces: realmedia cookie
1:43 AM: Quarantining All Traces: servedby advertising cookie
1:43 AM: Quarantining All Traces: trojan downloader pops-stop
1:43 AM: Quarantining All Traces: shopathomeselect
1:43 AM: Warning: Quarantine could not read registry value for HKU\S-1-5-21-2403904371-3563561673-3378400465-1003\software\cmapp\client\registered\. Failed to export registry value "S-1-5-21-2403904371-3563561673-3378400465-1003\software\cmapp\client\registered". Key/Value does not exist
1:43 AM: Removal process completed. Elapsed time 00:01:02
********
1:36 AM: |··· Start of Session, Wednesday, August 31, 2005 ···|
1:36 AM: Spy Sweeper started
1:37 AM: |··· End of Session, Wednesday, August 31, 2005 ···|

[Buckeye_Sam]

You actually posted the last two scans from Spysweeper, which threw me off for a second until I figured it out.

But it looks very good!

I'll leave the thread open for a couple weeks in case you have any trouble. In the meantime...

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Renable system restore with instructions from tutorial above
  
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

[Buckeye_Sam]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.