[msimpson]

My PC has had several bouts of popups and spyware. I have removed them using the unistallers, and Ad-Aware, but 2 days later they re-appear. I have run all the ususal progs to delete. HJT log is below - Am I clean, or are they going to resurface?

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 8/4/05
Get updates at http://www.greyknigh...ad.htm#programs

***Security Programs Detected***


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 13:33:22, on 16/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avsynmgr.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\windows\sp2update.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\USER\Application Data\Mozilla\Profiles\default\3cmjvcka.slt\prefs.js)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [msresearch] C:\WINDOWS\msresearch.exe
O4 - HKLM\..\Run: [sp2update] C:\windows\sp2update.exe
O4 - HKLM\..\Run: [whsdkac] c:\windows\system32\yedzgwc.exe r
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: GIC - https://www.ib.albb..../ie/classes.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.co...etup1.0.0.8.cab
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager...unttracking.cab
O16 - DPF: {630F2610-7654-11D1-83E3-0080C71A8794} (Interconnect Resources) - https://www.ib.albb..../ebs/ie/gic.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro....er/PROFILER.CAB
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avsynmgr.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: McShield - Network Associates, Inc. - C:\PROGRA~1\COMMON~1\NETWOR~1\McShield\Mcshield.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe


End of KRC HijackThis Analyzer Log.
====================================================================

[Advertisements]

Hello and welcome!

Can you post the entire HJT log.. Analyzers usually miss few BAD lines from time to time. I guess that's why you're here anyway.. To let the staff analyze your log and help you get the PC clean, right?

Can you do this first.. Make sure you're version of Ad-aware is the most latest one (1.06). If not, get it here; http://www.download....4-10045910.html

Remember to uninstall any older versions, then delete the folder C:\Program Files\Lavasoft

And install then the latest one.. Do the following;

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon, Click "connect", Click "OK", Click "Finish".)

IF you are having problems with the updating, get the manual updates here; http://download.lava...public/defs.zip

2. Set up the Configurations as follows:

• Click the Gear wheel at the top of the Ad-Aware window
  
• Click General > Safety & Settings: Check (Green) all three.
  
• Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".

3. Click on "Proceed"
4. Click on "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to every "target family" for removal.
11. Click "Next", Click "OK".
12. Reboot.

Run a new scan with HiJackThis and post the ENTIRE log here from notepad directly, no need for online analyzers

- Rawe

[Rawe]

Hello and welcome!

Can you post the entire HJT log.. Analyzers usually miss few BAD lines from time to time. I guess that's why you're here anyway.. To let the staff analyze your log and help you get the PC clean, right?

Can you do this first.. Make sure you're version of Ad-aware is the most latest one (1.06). If not, get it here; http://www.download....4-10045910.html

Remember to uninstall any older versions, then delete the folder C:\Program Files\Lavasoft

And install then the latest one.. Do the following;

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon, Click "connect", Click "OK", Click "Finish".)

IF you are having problems with the updating, get the manual updates here; http://download.lava...public/defs.zip

2. Set up the Configurations as follows:

• Click the Gear wheel at the top of the Ad-Aware window
  
• Click General > Safety & Settings: Check (Green) all three.
  
• Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".

3. Click on "Proceed"
4. Click on "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to every "target family" for removal.
11. Click "Next", Click "OK".
12. Reboot.

Run a new scan with HiJackThis and post the ENTIRE log here from notepad directly, no need for online analyzers

- Rawe

[msimpson]

Hi Rawe,

Thanks for the quick reply.

Yes I am using the latest Ad-Aware and updates, and have run per the below configurations.

Full log is below, Thanks Mark

Logfile of HijackThis v1.99.1
Scan saved at 13:33:22, on 16/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avsynmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\pctspk.exe
C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Apoint\Apoint.exe
C:\windows\sp2update.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\USER\Application Data\Mozilla\Profiles\default\3cmjvcka.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [msresearch] C:\WINDOWS\msresearch.exe
O4 - HKLM\..\Run: [sp2update] C:\windows\sp2update.exe
O4 - HKLM\..\Run: [whsdkac] c:\windows\system32\yedzgwc.exe r
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: GIC - https://www.ib.albb..../ie/classes.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.co...etup1.0.0.8.cab
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager...unttracking.cab
O16 - DPF: {630F2610-7654-11D1-83E3-0080C71A8794} (Interconnect Resources) - https://www.ib.albb..../ebs/ie/gic.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro....er/PROFILER.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avsynmgr.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: McShield - Network Associates, Inc. - C:\PROGRA~1\COMMON~1\NETWOR~1\McShield\Mcshield.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

[Rawe]

Please download APT and unzip the contents to a new folder on your desktop.

• Open the folder you just created and click on apt.exe and search in the window for yedzgwc.exe.
• Open your C:\Windows\system32 folder and search for c:\windows\system32\yedzgwc.exe.
  Don't delete it yet, just leave the system32 folder open so you can see the bad file.
• In APT again, Select yedzgwc.exe and Click Kill3
  
• Then immediately delete c:\windows\system32\yedzgwc.exe from your system32 folder.

Close APT.

Run a scan with HiJackThis and check the following objects for removal;

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [msresearch] C:\WINDOWS\msresearch.exe
O4 - HKLM\..\Run: [sp2update] C:\windows\sp2update.exe
O4 - HKLM\..\Run: [whsdkac] c:\windows\system32\yedzgwc.exe r
O16 - DPF: GIC - https://www.ib.albb..../ie/classes.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.co...etup1.0.0.8.cab

Make sure all your other windows are closed except for HiJackThis and click FIX CHECKED.

Then reboot. Delete the following files;

C:\WINDOWS\msresearch.exe
C:\windows\sp2update.exe

Empty recycle bin. Post another HijackThis log.

- Rawe

[msimpson]

Have run APT, but could not find yedzgwc.exe, nor was this in the system32 folder.
Otherwise followed instructions. Below is HJT log:

Thanks, Mark

Logfile of HijackThis v1.99.1
Scan saved at 17:57:48, on 16/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avsynmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\VsStat.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\Vshwin32.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\PROGRA~1\COMMON~1\NETWOR~1\McShield\Mcshield.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\pctspk.exe
C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Apoint\Apntex.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\USER\Application Data\Mozilla\Profiles\default\3cmjvcka.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager...unttracking.cab
O16 - DPF: {630F2610-7654-11D1-83E3-0080C71A8794} (Interconnect Resources) - https://www.ib.albb..../ebs/ie/gic.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro....er/PROFILER.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avsynmgr.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: McShield - Network Associates, Inc. - C:\PROGRA~1\COMMON~1\NETWOR~1\McShield\Mcshield.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

[Rawe]

Your log's not looking bad at-all..

Please do an online scan with Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Standard
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This program will start to scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

- Rawe

[msimpson]

Results below I did run a Dr Solomons scan this morning!

Mark
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Tuesday, August 16, 2005 20:20:45
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 16/08/2005
Kaspersky Anti-Virus database records: 135526
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 92963
Number of viruses found: 12
Number of infected objects: 91
Number of suspicious objects: 10
Duration of the scan process: 5281 sec

Infected Object Name - Virus Name
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From "PayPal Security Department" <[email protected]>][Date Wed, 06 Apr 2005 01:11:20 -0400]/UNNAMED/html Infected: Trojan-Spy.HTML.Paylap.dh
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From "PayPal Security Department" <[email protected]>][Date Wed, 06 Apr 2005 01:11:20 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.dh
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 11 Apr 2005 22:53:21 +0500]/UNNAMED/your_picture.pif Infected: Email-Worm.Win32.NetSky.d
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 11 Apr 2005 22:53:21 +0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 21 Apr 2005 15:57:00 +0100]/UNNAMED/readme.doc Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 21 Apr 2005 15:57:00 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Apr 2005 17:21:28 +0100]/UNNAMED/important_stephanie.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Apr 2005 17:21:28 +0100]/UNNAMED/important_stephanie.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Apr 2005 17:21:28 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 12 May 2005 09:49:11 -0700]/UNNAMED/details.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 12 May 2005 09:49:11 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 17 May 2005 03:10:57 -0700]/UNNAMED/product.zip/document.txt .exe Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 17 May 2005 03:10:57 -0700]/UNNAMED/product.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 17 May 2005 03:10:57 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sat, 7 May 2005 10:20:29 +0100]/UNNAMED/d4334938.doc Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sat, 7 May 2005 10:20:29 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 24 May 2005 08:30:15 -0700]/UNNAMED/message_stephanie.pif Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 24 May 2005 08:30:15 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 24 May 2005 22:02:38 -0700]/UNNAMED/website.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 24 May 2005 22:02:38 -0700]/UNNAMED/website.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 24 May 2005 22:02:38 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 2 Jun 2005 08:21:37 -0700]/UNNAMED/readme.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 2 Jun 2005 08:21:37 -0700]/UNNAMED/readme.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 2 Jun 2005 08:21:37 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 3 Jun 2005 09:23:22 -0700]/UNNAMED/sample01_stephanie.doc.pif Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 3 Jun 2005 09:23:22 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sun, 5 Jun 2005 02:32:49 -0700]/UNNAMED/readme.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sun, 5 Jun 2005 02:32:49 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 7 Jun 2005 23:20:11 -0700]/UNNAMED/message.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 7 Jun 2005 23:20:11 -0700]/UNNAMED/message.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 7 Jun 2005 23:20:11 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 27 May 2005 15:46:14 +0100]/UNNAMED/document04_stephanie.doc Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 27 May 2005 15:46:14 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sat, 28 May 2005 10:31:50 +0100]/UNNAMED/data.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sat, 28 May 2005 10:31:50 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 31 May 2005 12:54:16 +0100]/UNNAMED/screensaver_stephanie.doc.exe Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 31 May 2005 12:54:16 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 10 Jun 2005 11:19:11 -0700]/info02.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 10 Jun 2005 11:19:11 -0700]/info02.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From warn.bl.kundenserver.de says: This mail has been received from a dialup host.][Date Thu, 23 Jun 2005 10:24:34 +0100]/product.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From warn.bl.kundenserver.de says: This mail has been received from a dialup host.][Date Thu, 23 Jun 2005 10:24:34 +0100]/product.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 8 Jul 2005 15:51:03 +0530]/UNNAMED/message.zip/document.txt .exe Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 8 Jul 2005 15:51:03 +0530]/UNNAMED/message.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Fri, 8 Jul 2005 15:51:03 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sat, 9 Jul 2005 13:24:28 +0530]/UNNAMED/message.zip/document.txt .exe Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sat, 9 Jul 2005 13:24:28 +0530]/UNNAMED/message.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sat, 9 Jul 2005 13:24:28 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 13 Jul 2005 18:23:35 +0530]/UNNAMED/document_stephanie.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 13 Jul 2005 18:23:35 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 18 Jul 2005 16:12:55 +0530]/UNNAMED/readme.exe Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 18 Jul 2005 16:12:55 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 19 Jul 2005 11:59:02 +0530]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 19 Jul 2005 11:59:02 +0530]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 19 Jul 2005 11:59:02 +0530]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 19 Jul 2005 11:59:02 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 19 Jul 2005 16:50:29 +0530]/UNNAMED/all_in_all.pif Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 19 Jul 2005 16:50:29 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 20 Jul 2005 13:38:26 +0530]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 20 Jul 2005 13:38:26 +0530]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 20 Jul 2005 13:38:26 +0530]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 20 Jul 2005 13:38:26 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 20 Jul 2005 13:38:27 +0530]/UNNAMED/message_stephanie.doc Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 20 Jul 2005 13:38:27 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sun, 24 Jul 2005 16:25:23 +0530]/UNNAMED/info02.txt Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Sun, 24 Jul 2005 16:25:23 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 25 Jul 2005 12:02:21 +0530]/UNNAMED/readme.doc Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 25 Jul 2005 12:02:21 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 25 Jul 2005 17:24:41 +0530]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 25 Jul 2005 17:24:41 +0530]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 25 Jul 2005 17:24:41 +0530]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Mon, 25 Jul 2005 17:24:41 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 26 Jul 2005 16:35:09 +0530]/UNNAMED/archive.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Tue, 26 Jul 2005 16:35:09 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 27 Jul 2005 16:11:56 +0530]/UNNAMED/list_ed.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 27 Jul 2005 16:11:56 +0530]/UNNAMED/list_ed.zip Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 27 Jul 2005 16:11:56 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 27 Jul 2005 16:11:57 +0530]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 27 Jul 2005 16:11:57 +0530]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 27 Jul 2005 16:11:57 +0530]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Wed, 27 Jul 2005 16:11:57 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Jul 2005 14:25:57 +0530]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Jul 2005 14:25:57 +0530]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Jul 2005 14:25:57 +0530]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Jul 2005 14:25:57 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Jul 2005 18:46:04 +0530]/UNNAMED/letter.txt.exe Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx/[From [email protected]][Date Thu, 28 Jul 2005 18:46:04 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Application Data\Identities\{DEB99006-2ABA-48A2-B454-BB51952655AA}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Email-Worm.Win32.NetSky.q
C:\Documents and Settings\USER\Local Settings\Temp\Del1BC.tmp Infected: Trojan-Downloader.Win32.Small.asf
C:\Documents and Settings\USER\Local Settings\Temp\iinstall.exe Infected: Trojan-Downloader.Win32.IstBar.li
C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\CDMJ49EV\power_remove[1].exe Infected: Trojan-Downloader.Win32.IstBar.gi
C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\M7ILQ5GL\istdownload[1].exe Infected: Trojan-Downloader.Win32.IstBar.li
C:\Program Files\Common Files\aol\AOL Spyware Protection\Backup\QFle08132005222516036949.asw Infected: Trojan-Downloader.Win32.Small.asf
C:\Program Files\Common Files\aol\AOL Spyware Protection\Backup\QFle0816200510356585990.asw Infected: Trojan-Downloader.Win32.Small.asf
C:\System Volume Information\_restore{3791CC8F-C624-4733-B596-1EEC79EE77B3}\RP411\A0086871.exe Infected: Trojan-Downloader.Win32.IstBar.gi
C:\System Volume Information\_restore{3791CC8F-C624-4733-B596-1EEC79EE77B3}\RP414\A0087274.exe Infected: Trojan-Downloader.Win32.VB.nh
C:\System Volume Information\_restore{3791CC8F-C624-4733-B596-1EEC79EE77B3}\RP414\A0087278.exe Infected: Trojan.Win32.StartPage.aw
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ysbactivex.dll Infected: Trojan-Downloader.Win32.IstBar.gen
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\ysbactivex.dll Infected: Trojan-Downloader.Win32.IstBar.gen
C:\WINDOWS\Downloaded Program Files\movie.ocx Infected: Trojan-Downloader.Win32.Agent.ex
C:\WINDOWS\Downloaded Program Files\ysbactivex.dll Infected: Trojan-Downloader.Win32.IstBar.gen
C:\WINDOWS\SSK3_B5.exe Infected: Trojan-Dropper.Win32.Small.qn

Scan process completed.

[Rawe]

Please print these instructions out, or write them down, as you can't read them during the fix.

Download CleanUp
Install the program, dont run it yet, we will later.

First;

Please download Ewido Security Suite it is a free version of the program.

• Install Ewido Security Suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch Ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run Ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update Ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")
• Exit Ewido. DO NOT run a scan yet.

If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Now run the CleanUp program:

*IMPORTANT NOTE*
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp

Running CleanUp

• Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• When CleanUp starts go to the Options button (right side of CleanUp screen)
• Move the arrow down to "Custom CleanUp!"
• Now place a checkmark next to the following (Make sure nothing else is checked!):
  • Delete Cookies
    This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
  • Empty Recycle Bins
  • Delete Prefetch files
  • Cleanup! All Users
• Click OK
• Then click on the CleanUp button. This will take a short while, let it do its thing.
• When asked to reboot system select No
• Close CleanUp

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Now open Ewido and do a scan of your system.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• Clean anything it finds.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

Close Ewido.

Then reboot back into normal mode and post the Ewido log here along with a fresh HijackThis log.

- Rawe

[msimpson]

Phew, ran all that as below (virus scanner disabled),

Thanks, Mark

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 22:25:23, 16/08/2005
+ Report-Checksum: 6C17E97F

+ Scan result:

HKU\S-1-5-21-1708537768-484763869-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-21-1708537768-484763869-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10E42047-DEB9-4535-A118-B3F6EC39B807} -> Spyware.SideFind : Cleaned with backup
HKU\S-1-5-21-1708537768-484763869-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{79849612-A98F-45B8-95E9-4D13C7B6B35C} -> Spyware.Crazywinnings : Cleaned with backup
HKU\S-1-5-21-1708537768-484763869-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{86227D9C-0EFE-4F8A-AA55-30386A3F5686} -> Spyware.YourSiteBar : Cleaned with backup
HKU\S-1-5-21-1708537768-484763869-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.ISTBar : Cleaned with backup
HKU\S-1-5-21-1708537768-484763869-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\Common Files\aol\AOL Spyware Protection\Backup\QFle08132005222516036949.asw -> TrojanDownloader.Small.asf : Cleaned with backup
C:\Program Files\Common Files\aol\AOL Spyware Protection\Backup\QFle0816200510356585990.asw -> TrojanDownloader.Small.asf : Cleaned with backup
C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll -> Spyware.MyWebSearch : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ysbactivex.dll -> TrojanDownloader.IstBar : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\ysbactivex.dll -> TrojanDownloader.IstBar : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\movie.ocx -> TrojanDownloader.Agent.ex : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\ysbactivex.dll -> TrojanDownloader.IstBar : Cleaned with backup
C:\WINDOWS\SSK3_B5.exe -> TrojanDropper.Small.qn : Cleaned with backup


::Report End

Logfile of HijackThis v1.99.1
Scan saved at 22:29:57, on 16/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avsynmgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avconsol.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\pctspk.exe
C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\USER\Application Data\Mozilla\Profiles\default\3cmjvcka.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager...unttracking.cab
O16 - DPF: {630F2610-7654-11D1-83E3-0080C71A8794} (Interconnect Resources) - https://www.ib.albb..../ebs/ie/gic.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro....er/PROFILER.CAB
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\PROGRA~1\NETWOR~1\VIRUSS~1\Avsynmgr.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: McShield - Network Associates, Inc. - C:\PROGRA~1\COMMON~1\NETWOR~1\McShield\Mcshield.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

[Rawe]

Please download Trend Micro™ Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button).

• Save it to your desktop.
• Double-click the new icon on your desktop (tmas-web-scan.exe)
• It will say "Loading TrendMicro definitions".
• Once the definitions are loaded, the program will appear to close then re-open.
• Click "Start Scan"
• After it's done scanning, click "Scan Results"
• Make sure all items found have a check next to them, then click "Clean Threats Now".
• Click Exit.

Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them here.

- Rawe

[Rawe]

Did you disable your Anti-virus software?
Not recommended.. Please turn it back on. Ewido is actually compatible with them.

- Rawe

[Rawe]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.