[puertorico]

HELP! I was having problems with ad.yieldmanager and winfixer ads and ran adaware and spybot on safe mode but they did not go away, then i found this forum and proceeded to do a thorough cleaning. following ALL of your steps to clean the computer.
-cleaned all temp files
-ran adaware
-ran cwshredder
-ran spybot
-compare my antivirus/antispyware to the list
-ran ewido (found several things, log is below, i the cookies i deleted from explorer afterwards)
-ran housecall
-ran trojanhunter
-i have sp2

rebooted. worked fine for about 6 minutes and bam! more ads for antivirus software, ads from searchinqwire, and other ones that don't say where they are coming from but they close all my browser windows when i end the task. i even got one with sound for the first time! i am running symantec antivirus from my company, as well as microsoft antispyware, on top of what i did above.

here is my hijack this file followed by ewido. THANKS SOOOOO MUCH!!!!!!!!!!!!


Logfile of HijackThis v1.99.1
Scan saved at 6:51:53 AM, on 8/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Connected\AgentSrv.EXE
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\PROGRA~1\CYBERG~1\cgasvc.exe
C:\PROGRA~1\CYBERG~1\cgagent.exe
c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\notes\ntmulti.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\netDeploy\Launcher\ndserv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\System32\CCM\CcmExec.exe
C:\Program Files\CyberArmor\casvc.exe
C:\PROGRA~1\CYBERA~1\pcs.exe
C:\PROGRA~1\CYBERA~1\pcshelp.exe
C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\DELL\AccessDirect\dadapp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\CYBERG~1\cgahelp.exe
C:\PROGRA~1\CYBERG~1\cgav.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\CyberArmor\pcshelp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\m?hta.exe
C:\Program Files\sror\etos.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Connected\CBSysTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\a0384836\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.ti.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://my.ti.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://my.ti.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconfig.i...i.com/proxy.pac
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {CDA0A340-13D4-4001-DA2E-3BE60A8A02BF} - C:\WINDOWS\System32\gaphgukt.dll
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\System32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\DELL\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CgaHelper] C:\PROGRA~1\CYBERG~1\cgahelp.exe -check
O4 - HKLM\..\Run: [CgaViewer] C:\PROGRA~1\CYBERG~1\cgav.exe -check
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CyberArmorHelper] C:\Program Files\CyberArmor\pcshelp.exe -check
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Wstopk] C:\WINDOWS\System32\?ti2evxx.exe
O4 - HKCU\..\Run: [Jlw] C:\WINDOWS\System32\m?hta.exe
O4 - HKCU\..\Run: [Bunp] C:\Program Files\sror\etos.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MasterCook: Select Image - C:\Program Files\MasterCook 8\Web\MCIEContext.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: MasterCook Web Import Bar - {E6EF5071-7647-4E85-9785-87B6CF5CB561} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Concur Expense Applets - https://expense.itg..../cnqr2k3_ie.cab
O16 - DPF: {01118400-3E00-11D2-8470-0060089874ED} (SdcNetCheckCtl Class) - http://activex.micro...jects/ocget.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120352924586
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\Software\..\Telephony: DomainName = ent.ti.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: cahooknt.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - Service: Connected Agent Service (AgentSrv) - Connected Corporation - C:\Program Files\Connected\AgentSrv.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberGatekeeper Agent (CGAgent) - InfoExpress - C:\PROGRA~1\CYBERG~1\cgasvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: CyberArmor Run Service (CyberArmorRunService) - InfoExpress - C:\Program Files\CyberArmor\casvc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Multi-user Cleanup Service - Unknown owner - C:\Program Files\notes\ntmulti.exe
O23 - Service: ndserv - Open Software Associates Ltd. - C:\Program Files\netDeploy\Launcher\ndserv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe



ewido file:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 8:40:10 PM, 8/25/2005
+ Report-Checksum: 903C7B4

+ Scan result:

HKU\S-1-5-21-1315882459-817801392-1359842108-99924\Software\Bundles -> Spyware.SecondThought : Cleaned with backup
HKU\S-1-5-21-1315882459-817801392-1359842108-99924\Software\Dvx -> Spyware.Delfin : Cleaned with backup
C:\Documents and Settings\a0384836\Local Settings\Application Data\Wildtangent\Cdacache\00\00\07.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
C:\Program Files\Connected\COBackup.exe -> Heuristic.Win32.Dialer : Cleaned with backup
C:\Program Files\ipass\ipassconnect\idialer.exe -> Heuristic.Win32.Dialer : Cleaned with backup
:mozilla.7:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.8:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.9:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.10:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.161:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.192:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.193:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.194:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.195:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.233:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.234:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.235:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.236:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.237:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.241:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.242:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.243:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.244:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.245:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.246:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.266:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.275:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.295:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.296:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.314:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.322:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.323:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.391:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.399:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.424:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.425:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.430:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.439:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.440:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.442:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.449:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.457:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.487:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.488:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.489:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.490:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.491:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.492:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.493:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.494:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.507:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.546:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.695:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.759:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.771:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.895:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.896:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.897:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.898:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.899:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.925:C:\Program Files\support.com\backup\co\cookies.txt\92306_5c096d8c2_/cookies.txt -> Spyware.Cookie.Weborama : Error during cleaning
:mozilla.122:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.123:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.124:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.231:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.255:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.256:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.257:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.258:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.290:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.291:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.292:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.293:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.294:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.298:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.299:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.300:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.301:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.302:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.303:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.323:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.331:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.351:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.352:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.368:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.369:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.370:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.378:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.379:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.445:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.453:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.474:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.475:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.480:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.489:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.490:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.492:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.499:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.507:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.525:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.526:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.527:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.528:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.529:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.530:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.531:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.532:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.545:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.579:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.722:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.769:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.777:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.901:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.902:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.903:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.904:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.905:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.931:C:\Program Files\support.com\backup\co\cookies.txt\93097_50ffa0f99_/cookies.txt -> Spyware.Cookie.Weborama : Error during cleaning
:mozilla.59:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.60:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.62:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.70:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.71:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.72:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.73:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.93:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.94:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.95:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.96:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.97:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.178:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.179:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.180:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.181:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.182:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.183:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.350:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.351:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.362:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.365:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.366:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.451:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.466:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.494:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.496:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.497:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.498:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.499:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.500:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.627:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.638:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.643:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.644:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.645:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.646:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.647:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.665:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.681:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.682:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.695:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Weborama : Error during cleaning
:mozilla.728:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.729:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Esomniture : Error during cleaning
:mozilla.779:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.780:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.833:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.834:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.835:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.836:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.849:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.852:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.914:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.972:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.974:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.Mediaplex : Error during cleaning
:mozilla.979:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.980:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.981:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.982:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.983:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.984:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.985:C:\Program Files\support.com\backup\co\cookies.txt\93432_5c412ae16_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.128:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.129:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.130:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.131:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.132:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.133:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.134:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.266:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.267:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.268:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.269:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.270:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Serving-sys : Error during cleaning
:mozilla.281:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.282:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.283:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Burstnet : Error during cleaning
:mozilla.289:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.290:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.301:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.304:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.305:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.392:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.407:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.427:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.428:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.429:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.444:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.446:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.447:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.448:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.449:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.450:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Statcounter : Error during cleaning
:mozilla.588:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.605:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.610:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.611:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.612:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.613:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.614:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Bluemountain : Error during cleaning
:mozilla.632:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.648:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.649:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.662:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Weborama : Error during cleaning
:mozilla.699:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.700:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Esomniture : Error during cleaning
:mozilla.751:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.752:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.805:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.806:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.807:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.808:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.821:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.824:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.886:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.945:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.947:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.Mediaplex : Error during cleaning
:mozilla.952:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.953:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.954:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.955:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.956:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.957:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.958:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.959:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.960:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.961:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.962:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.963:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.964:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.965:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.966:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.967:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.968:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.969:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.970:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.971:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.972:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.973:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.974:C:\Program Files\support.com\backup\co\cookies.txt\93495_570d4cc9a_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.975:C:\Program Files\support.com\backup\co\cookies.txt\93

Edited by Michelle, 26 August 2005 - 09:09 AM.

[Advertisements]

Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

[tampabelle]

Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

[puertorico]

Hello Tampabelle,

Here is the log you asked for:
L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Asynchronous"=dword:00000000
"Dllname"="C:\\WINDOWS\\System32\\LgNotify.dll"
"Impersonate"=dword:00000000
"Logon"="SebringUserLogon"
"Logoff"="SebringUserLogoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"Texas Instruments, Inc"="IEAKTexas Instruments, Inc"
"SV1"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{1530F7EE-5128-43BD-9977-84A4B0FAD7DF}"="PhotoToys"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{2F603045-309F-11CF-9774-0020AFD0CFF6}"="Synaptics Control Panel"
"{E0D79300-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79301-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79302-84BE-11CE-9641-444553540000}"="WinZip"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{6af09ec9-b429-11d4-a1fb-0090960218cb}"="My Bluetooth Places"
"{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{506F4668-F13E-4AA1-BB04-B43203AB3CC0}"="{506F4668-F13E-4AA1-BB04-B43203AB3CC0}"
"{D66DC78C-4F61-447F-942B-3FB6980118CF}"="{D66DC78C-4F61-447F-942B-3FB6980118CF}"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}"="TrojanHunter Menu Shell Extension"
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
gccoll~1.dll Tue Jul 12 2005 3:35:14p A.... 126,680 123.71 K
gcunco~1.dll Tue Jul 12 2005 3:35:10p A.... 95,448 93.21 K
hashlib.dll Tue Jul 12 2005 3:35:14p A.... 117,976 115.21 K
icm32.dll Tue Jun 28 2005 8:46:00p A.... 254,976 249.00 K
kerberos.dll Wed Jun 15 2005 12:49:30p A.... 295,936 289.00 K
mscms.dll Tue Jun 28 2005 8:46:00p A.... 74,240 72.50 K
s32evnt1.dll Tue Aug 23 2005 1:05:18p A.... 83,208 81.26 K
sirenacm.dll Sat Aug 13 2005 2:41:12p A.... 118,784 116.00 K
tapisrv.dll Fri Jul 8 2005 11:27:56a A.... 249,344 243.50 K
umpnpmgr.dll Wed Jun 29 2005 9:02:40p A.... 118,272 115.50 K

10 items found: 10 files, 0 directories.
Total of file sizes: 1,534,864 bytes 1.46 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 547A-DFC9

Directory of C:\WINDOWS\System32

08/15/2005 01:07 PM 401,408 m?hta.exe
07/02/2005 08:17 PM <DIR> dllcache
12/13/2004 02:42 PM <DIR> deleted
08/03/2004 04:09 PM <DIR> Microsoft
1 File(s) 401,408 bytes
3 Dir(s) 20,103,397,376 bytes free

Edited by puertorico, 04 September 2005 - 08:27 PM.

[tampabelle]

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log, and we'll clean up what's left.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[puertorico]

Hello Tampabelle. Sorry for the delay. I am in Dallas and was volunteering at the shelter for a few days. I ran the l2mfix.bat option 2. Here is the log:
BTW: thanks so much for helping me fix this really annoying computer!!!!



Setting Directory
C:\
C:\
System Rebooted!

Running From:
C:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 3116 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 3124 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!

Zipping up files for submission:
adding: Navntutl.dll (148 bytes security) (deflated 58%)
adding: clear.reg (188 bytes security) (deflated 2%)
adding: proxy_language_english.ini (188 bytes security) (deflated 62%)
adding: lo2.txt (188 bytes security) (deflated 52%)
adding: log.txt (188 bytes security) (deflated 39%)
adding: test.txt (188 bytes security) (stored 0%)
adding: test2.txt (188 bytes security) (stored 0%)
adding: test3.txt (188 bytes security) (stored 0%)
adding: test5.txt (188 bytes security) (stored 0%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

Restoring Windows Update Certificates.:


The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Asynchronous"=dword:00000000
"Dllname"="C:\\WINDOWS\\System32\\LgNotify.dll"
"Impersonate"=dword:00000000
"Logon"="SebringUserLogon"
"Logoff"="SebringUserLogoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************


Here is my HIJACKTHIS Log:
Logfile of HijackThis v1.99.1
Scan saved at 9:43:15 PM, on 9/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Connected\AgentSrv.EXE
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\PROGRA~1\CYBERG~1\cgasvc.exe
C:\PROGRA~1\CYBERG~1\cgagent.exe
c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\notes\ntmulti.exe
C:\Program Files\netDeploy\Launcher\ndserv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\System32\CCM\CcmExec.exe
C:\Program Files\CyberArmor\casvc.exe
C:\PROGRA~1\CYBERA~1\pcs.exe
C:\PROGRA~1\CYBERA~1\pcshelp.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\System32\1XConfig.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\a0384836\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.ti.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://my.ti.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://my.ti.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconfig.i...i.com/proxy.pac
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {CDA0A340-13D4-4001-DA2E-3BE60A8A02BF} - C:\WINDOWS\System32\gaphgukt.dll
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\System32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\DELL\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CgaHelper] C:\PROGRA~1\CYBERG~1\cgahelp.exe -check
O4 - HKLM\..\Run: [CgaViewer] C:\PROGRA~1\CYBERG~1\cgav.exe -check
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CyberArmorHelper] C:\Program Files\CyberArmor\pcshelp.exe -check
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Wstopk] C:\WINDOWS\System32\?ti2evxx.exe
O4 - HKCU\..\Run: [Jlw] C:\WINDOWS\System32\m?hta.exe
O4 - HKCU\..\Run: [Bunp] C:\Program Files\sror\etos.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MasterCook: Select Image - C:\Program Files\MasterCook 8\Web\MCIEContext.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: MasterCook Web Import Bar - {E6EF5071-7647-4E85-9785-87B6CF5CB561} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Concur Expense Applets - https://expense.itg..../cnqr2k3_ie.cab
O16 - DPF: {01118400-3E00-11D2-8470-0060089874ED} (SdcNetCheckCtl Class) - http://activex.micro...jects/ocget.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120352924586
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\Software\..\Telephony: DomainName = ent.ti.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: cahooknt.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - Service: Connected Agent Service (AgentSrv) - Connected Corporation - C:\Program Files\Connected\AgentSrv.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberGatekeeper Agent (CGAgent) - InfoExpress - C:\PROGRA~1\CYBERG~1\cgasvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: CyberArmor Run Service (CyberArmorRunService) - InfoExpress - C:\Program Files\CyberArmor\casvc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Multi-user Cleanup Service - Unknown owner - C:\Program Files\notes\ntmulti.exe
O23 - Service: ndserv - Open Software Associates Ltd. - C:\Program Files\netDeploy\Launcher\ndserv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

[tampabelle]

Please print out these instructions or copy them into a text file on your Desktop for easy access.

During the fix, u will be asked to fix some entries, delete some files or uninstall some programs. If in case, you do not see those entries / files / programs, please make a note of it. Continue with the fix and in your next post please inform me of all deviations from the fix prescribed.

1. Download Programs

Please download these programs and save them in a new folder on your desktop -

CleanUp


2. Run Hijack This

Run Hijack This and click on scan. The following items need to be fixed -

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {CDA0A340-13D4-4001-DA2E-3BE60A8A02BF} - C:\WINDOWS\System32\gaphgukt.dll
O4 - HKCU\..\Run: [Wstopk] C:\WINDOWS\System32\?ti2evxx.exe
O4 - HKCU\..\Run: [Jlw] C:\WINDOWS\System32\m?hta.exe
O4 - HKCU\..\Run: [Bunp] C:\Program Files\sror\etos.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: cahooknt.dll

Close all windows other than Hijack This. Check the boxes next to above items and click on Fix checked.

Restart the PC in Safe Mode (repeatedly tap the F8 key when the PC is starting up).

3. Delete Rogue files

Run CleanUp and delete all temp files including temporary internet files

Run Firefox. Click on Tools --> Options ---> Privacy. Clear the cookies and cache.

Run Ewido full scan. Let it fix any items it finds.

Open Windows Explorer (right click on Start and then click on explore). Locate and delete the following folders and files -

Folders
C:\Program Files\sror

Files
C:\WINDOWS\System32\gaphgukt.dll
C:\WINDOWS\System32\?ti2evxx.exe
C:\WINDOWS\System32\m?hta.exe
(please donot delete the file mshta.exe, a critical system file. If there are multiple instances of mshta.exe then make a note of the respective file sizes and the date of creation and post it back in your next reply)


Clear out the files in the Prefetch folder. Go to start> run> type into the box Prefetch. It will open the folder Prefetch. Delete all the files in that folder. Dont delete the folder, only the files in it !!!!!!!!


Reboot the PC in Normal Mode.


Run Hijack This and post a fresh HJT log along with Ewido scan report.

[puertorico]

Hello Tampabelle.

Okay, I did everything you told me to do. When I ran the fix from HijackThis, I got tthe attached error. Then, I did everything you asked for and ewido found nothing. I could not find the C:\WINDOWS\System32\gaphgukt.dll file. There are 2 mshta.exe files. One 29kb created on 8/4/2004, the other with 392kb created on 8/30/2005

Here is the HijackThis Scan followed by Ewido scans...

Thanx Tampabelle!

Logfile of HijackThis v1.99.1
Scan saved at 1:43:00 PM, on 9/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Connected\AgentSrv.EXE
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\PROGRA~1\CYBERG~1\cgasvc.exe
C:\PROGRA~1\CYBERG~1\cgagent.exe
c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\notes\ntmulti.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\netDeploy\Launcher\ndserv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\System32\CCM\CcmExec.exe
C:\Program Files\CyberArmor\casvc.exe
C:\PROGRA~1\CYBERA~1\pcs.exe
C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
C:\PROGRA~1\CYBERA~1\pcshelp.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\DELL\AccessDirect\dadapp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\CYBERG~1\cgahelp.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\CYBERG~1\cgav.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\PROGRA~1\CYBERG~1\cgahelp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\CyberArmor\pcshelp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Connected\CBSysTray.exe
C:\Documents and Settings\a0384836\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.ti.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://my.ti.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://my.ti.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconfig.i...i.com/proxy.pac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\System32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\DELL\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CgaHelper] C:\PROGRA~1\CYBERG~1\cgahelp.exe -check
O4 - HKLM\..\Run: [CgaViewer] C:\PROGRA~1\CYBERG~1\cgav.exe -check
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CyberArmorHelper] C:\Program Files\CyberArmor\pcshelp.exe -check
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MasterCook: Select Image - C:\Program Files\MasterCook 8\Web\MCIEContext.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: MasterCook Web Import Bar - {E6EF5071-7647-4E85-9785-87B6CF5CB561} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Concur Expense Applets - https://expense.itg..../cnqr2k3_ie.cab
O16 - DPF: {01118400-3E00-11D2-8470-0060089874ED} (SdcNetCheckCtl Class) - http://activex.micro...jects/ocget.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120352924586
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\Software\..\Telephony: DomainName = ent.ti.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - Service: Connected Agent Service (AgentSrv) - Connected Corporation - C:\Program Files\Connected\AgentSrv.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberGatekeeper Agent (CGAgent) - InfoExpress - C:\PROGRA~1\CYBERG~1\cgasvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: CyberArmor Run Service (CyberArmorRunService) - InfoExpress - C:\Program Files\CyberArmor\casvc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Multi-user Cleanup Service - Unknown owner - C:\Program Files\notes\ntmulti.exe
O23 - Service: ndserv - Open Software Associates Ltd. - C:\Program Files\netDeploy\Launcher\ndserv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

Ewido.

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 1:22:27 PM, 9/6/2005
+ Report-Checksum: 16D668BE

+ Scan result:

No infected objects found.





::Report End

[tampabelle]

Hi Puertorico,


Delete the mshta.exe file which is 392 kb in size and created on 8/30/2005.


Your HJT log looks fine.

Do you have any issues with your PC ???

If not then we can fine tune your PC now

[puertorico]

THANK YOU THANK YOU THANK YOU Tampabelle!!!!!! you have no idea, after almost 10 months with this problem i don't see any pop ups anymore!!!!!! Of course many people here reimaged my computer but since they dumped everything back on it, the spyware was still running! then they would scratch their heads and say, maybe you need to purchase a pop up blocker!!!! thanks so much!!!!!

my pc is deathly slow. but i thought that is normal. what do you mean by finetuning my pc? can you make it operate better, run faster, more protected? that would be swell

[tampabelle]

Let us clean up your PC a little bit.


Delete the following programs and the associated folders, which you downloaded during the cleaning up process -

l2mfix.exe
l2mfix folder


Uninstall Ewido as it is a trial product and the trial period will expire shortly. Conflicts can arise between multiple anti-virus programs and can severely hamper the performance of the PC.



Run Hijack This and click on scan. The following items need to be fixed -

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

Close all windows other than Hijack This. Check the boxes next to above items and click on Fix checked.

This will not delete the programs from your PC. This will only disable the programs from running at Start up and result in a faster PC. You can always run the programs manually by using the respective exe files or the shortcuts.

After this, please visit Windows security and critical updates and get all the updates and patches and install them on your PC.

Reboot the PC and post a fresh HJT log.

[puertorico]

Hello Tampabelle.
Did everything you asked me to. Running a lot better. THANKS!!!!!!!!!! Please tell me, what the heck did I have and how can i prevent it from happening again? you are amazing! Here is my HijackThis log.

Logfile of HijackThis v1.99.1
Scan saved at 10:18:16 PM, on 9/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Connected\AgentSrv.EXE
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\PROGRA~1\CYBERG~1\cgasvc.exe
C:\PROGRA~1\CYBERG~1\cgagent.exe
c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\notes\ntmulti.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\netDeploy\Launcher\ndserv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\System32\CCM\CcmExec.exe
C:\Program Files\CyberArmor\casvc.exe
C:\PROGRA~1\CYBERA~1\pcs.exe
C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\CYBERA~1\pcshelp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\DELL\AccessDirect\dadapp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\CYBERG~1\cgahelp.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\CYBERG~1\cgav.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\CyberArmor\pcshelp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Connected\CBSysTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Documents and Settings\a0384836\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.ti.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://my.ti.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://my.ti.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconfig.i...i.com/proxy.pac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\System32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\DELL\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CgaHelper] C:\PROGRA~1\CYBERG~1\cgahelp.exe -check
O4 - HKLM\..\Run: [CgaViewer] C:\PROGRA~1\CYBERG~1\cgav.exe -check
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CyberArmorHelper] C:\Program Files\CyberArmor\pcshelp.exe -check
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MasterCook: Select Image - C:\Program Files\MasterCook 8\Web\MCIEContext.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: MasterCook Web Import Bar - {E6EF5071-7647-4E85-9785-87B6CF5CB561} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Concur Expense Applets - https://expense.itg..../cnqr2k3_ie.cab
O16 - DPF: {01118400-3E00-11D2-8470-0060089874ED} (SdcNetCheckCtl Class) - http://activex.micro...jects/ocget.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120352924586
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\Software\..\Telephony: DomainName = ent.ti.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ent.ti.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = itg.ti.com,eps.ti.com,ppp.ti.com,sc.ti.com,ti.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - Service: Connected Agent Service (AgentSrv) - Connected Corporation - C:\Program Files\Connected\AgentSrv.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberGatekeeper Agent (CGAgent) - InfoExpress - C:\PROGRA~1\CYBERG~1\cgasvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: CyberArmor Run Service (CyberArmorRunService) - InfoExpress - C:\Program Files\CyberArmor\casvc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Multi-user Cleanup Service - Unknown owner - C:\Program Files\notes\ntmulti.exe
O23 - Service: ndserv - Open Software Associates Ltd. - C:\Program Files\netDeploy\Launcher\ndserv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

[tampabelle]

You haad look2me infection and a few random trojans on your PC !!!!


You can take measures to keep your PC clean and minimise the chances of infection in future. The mosst basic is be careful of where you go on the net, what you download and install on your PC. However these are not foolproof as people do come up with new ways of infecting PCs !!!!!!

[tampabelle]

Hi,

CONGRATULATIONS !!!!!!!!!!! Your PC is clean now



I would recommend the following steps to keep your PC clean (especially Step 1 to install critical Windows patches including Service Pack 2 or SP2 if not already installed and Step 8 now that your PC is clean) –

PREVENTIVE MEASURES FOR FUTURE

Operating System
1. Keep the Windows and Internet Explorer updated with the latest fixes. These fixes are available free from Microsoft. Click on Tools in the IE menu bar and then on Windows update. You can also use the following links

Windows security and critical updates
Internet Explorer security and critical updates

Also ensure that automatic updates are enabled for faster updation of the system.
(Right click on My Computer on your desktop, properties and Automatic Updates tab.


Anti-Virus Software
2. Keep your Anti-virus program updated with the latest definitions. Some of the common anti-virus programs in use are :

Norton Anti-Virus
McAfee Anti-Virus
AVG Anti-Virus --- freeware
Avast Home Edition --- freeware

Use only one anti-virus program as multiple such programs can create conflicts between themselves and severely hamper the performance of your PC.


Firewall
3. You should also have a good firewall. Here are 3 free ones available for personal use:
Sygate Personal Firewall, Kerio Personal Firewall, ZoneAlarm


Internet Browsers
4. Have robust explorer settings. It is preferable to use an internet browser other that IE as most of the malware is targetted at IE. In case you prefer to use IE, then download a list of innocent looking but harmful websites from IE-Spyad and install it on ur PC. IE-SPYAD puts over 5000 sites in your internet explorer's restricted zone, so you'll be protected when you visit innocent-looking sites that aren't really innocent at all.

Some alternate browsers I suggest are Firefox Mozilla Browser and Opera

Ensure that Security level, irrespective of whichever browser you use, is set at Medium or higher, restrict the usage of cookies and activeX components.


Spyware Protection
5. Have a wall of protection against spyware / adware by installing SpywareBlaster and SpywareGuard.

SpywareBlaster and SpywareGuard are by JavaCool and both are free programs.
SpywareBlaster will prevent spyware from being installed and consumes no system resources.
SpywareGuard offers realtime protection from spyware installation and browser hijack attempts. Both have free ongoing updates.


Spyware Removers
6. Install programs for scanning for malware and uninstalling them. Two of the best programs, both are freeware, are :

Spybot Search & Destroy - A powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

AdAware SE Personal Edition - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.


Regular Maintenance of PC
7. Finally, invest some time for regular maintenance of your PC. Delete the temporary Internet files, temporary files, cookies etc. Click on Start button, Programs, Accessories, System Tools and run the program Disk Cleanup. Follow the instructions.

An alternate freeware software which can be used is CleanUp.

Keep your Registry clean. My favourite software is Registry First Aid. This is not a freeware but a trial version can be downloaded.


System Restore Points
8. Since your PC is currently clean, create a system restore point. A system restore would enable you to revert to the settings on the PC when the restore point was created. It is also a good idea to flush all earlier system restore points which may be containing infected files.

A. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

B. Restart your computer.

C. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.

System Restore will now be active again.


Go ahead and enjoy a clean PC !!!!!!!!!!!!!

[puertorico]

THANKS TAMPABELLE. you are awesome!!!!!

[tampabelle]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.