Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

DesktopHijack [CLOSED]

Started by vicktory1955 , Sep 13 2005 01:17 PM

  • This topic is locked This topic is locked

#1
vicktory1955
Posted 13 September 2005 - 01:17 PM

vicktory1955

    New Member

  • Member
  • Pip
  • 3 posts
Hello,
I have the w32.desktophhigjck virus. norton is unable to repair this file. I used their support to try and clean it up....no luck. I have run all of the scans you requested, but am unable to do the security update as the installer says: C:windows/system32/wininet.dll is in use.
Thanks, Vicki

Logfile of HijackThis v1.99.1
Scan saved at 11:57:35 AM, on 9/13/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Atievxx.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\PcNicCtl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\tp4serv.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\WINDOWS\System32\Atiptaxx.exe
C:\WINDOWS\System32\ltcm000c.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\Program Files\Common Files\Symantec Shared\SymTray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\GlobeSoft\MultiNetwork Manager 6\NT\MNMControl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ORiNOCO\Client Manager\CmLUC.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\PROGRA~1\mozilla.org\Mozilla\Mozilla.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUMENTS AND SETTINGS\BOB\DESKTOP\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9
O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\Run: [MNM] "C:\Program Files\GlobeSoft\MultiNetwork Manager 6\NT\\MultiNetMgr.exe" -SysTray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lwinst Run Profiler] .\Lwtest.exe /detect /quiet /launch ".\Lwpevntm.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ORiNOCO Client Manager.lnk = C:\Program Files\ORiNOCO\Client Manager\CmLUC.exe
O4 - Global Startup: Shockwave Init.lnk = C:\WINDOWS\SYSTEM\MACROMED\Shockwave\SwInit.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1093634145369
O17 - HKLM\System\CCS\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{62DB549F-6BC7-404F-903C-595CE43FD958}: Domain = crewsoft.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{62DB549F-6BC7-404F-903C-595CE43FD958}: NameServer = 198.232.247.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O20 - Winlogon Notify: mnmwlxchain - C:\WINDOWS\SYSTEM32\NTGlobeBTA.dll
O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: IntelPcNicCtl - Unknown owner - C:\WINDOWS\System32\PcNicCtl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - c:\oracle\bin\omtsreco.exe
O23 - Service: OracleORAHOMEAgent - Oracle Corporation - c:\oracle\bin\agntsrvc.exe
O23 - Service: OracleORAHOMEClientCache - Unknown owner - c:\oracle\BIN\ONRSD.EXE
O23 - Service: OracleORAHOMEHTTPServer - Unknown owner - c:\oracle\Apache\Apache\apache.exe" --ntservice (file missing)
O23 - Service: OracleORAHOMEPagingServer - Unknown owner - c:\oracle/bin/pagntsrv.exe
O23 - Service: OracleORAHOMESNMPPeerEncapsulator - Unknown owner - c:\oracle\BIN\ENCSVC.EXE
O23 - Service: OracleORAHOMESNMPPeerMasterAgent - Unknown owner - c:\oracle\BIN\AGNTSVC.EXE
O23 - Service: OracleORAHOMETNSListener - Unknown owner - c:\oracle\BIN\TNSLSNR.exe
O23 - Service: OracleServiceCSI1 - Oracle Corporation - c:\oracle\bin\ORACLE.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - Unknown owner - C:\WINDOWS\System32\vmnetdhcp.exe (file missing)
  • 0

Advertisements

#2
loophole
Posted 17 September 2005 - 11:56 AM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Hello :tazz:

Sorry for the delayed response, it has been very busy lately.

If you still require help please post a new Hijack log in this
thread and I will help you. If your problem has been fixed please
respond and let us know.

Thanks
  • 0

#3
vicktory1955
Posted 17 September 2005 - 01:08 PM

vicktory1955

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Thanks! Still having trouble. Here is the hjt log.
Logfile of HijackThis v1.99.1
Scan saved at 11:54:32 AM, on 9/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Atievxx.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\PcNicCtl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\tp4serv.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\WINDOWS\System32\Atiptaxx.exe
C:\WINDOWS\System32\ltcm000c.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\Program Files\Common Files\Symantec Shared\SymTray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\GlobeSoft\MultiNetwork Manager 6\NT\MNMControl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\mozilla.org\Mozilla\Mozilla.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ORiNOCO\Client Manager\CmLUC.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\bob\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9
O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\Run: [MNM] "C:\Program Files\GlobeSoft\MultiNetwork Manager 6\NT\\MultiNetMgr.exe" -SysTray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lwinst Run Profiler] .\Lwtest.exe /detect /quiet /launch ".\Lwpevntm.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ORiNOCO Client Manager.lnk = C:\Program Files\ORiNOCO\Client Manager\CmLUC.exe
O4 - Global Startup: Shockwave Init.lnk = C:\WINDOWS\SYSTEM\MACROMED\Shockwave\SwInit.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1093634145369
O17 - HKLM\System\CCS\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{62DB549F-6BC7-404F-903C-595CE43FD958}: Domain = crewsoft.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{62DB549F-6BC7-404F-903C-595CE43FD958}: NameServer = 198.232.247.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O20 - Winlogon Notify: mnmwlxchain - C:\WINDOWS\SYSTEM32\NTGlobeBTA.dll
O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: IntelPcNicCtl - Unknown owner - C:\WINDOWS\System32\PcNicCtl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - c:\oracle\bin\omtsreco.exe
O23 - Service: OracleORAHOMEAgent - Oracle Corporation - c:\oracle\bin\agntsrvc.exe
O23 - Service: OracleORAHOMEClientCache - Unknown owner - c:\oracle\BIN\ONRSD.EXE
O23 - Service: OracleORAHOMEHTTPServer - Unknown owner - c:\oracle\Apache\Apache\apache.exe" --ntservice (file missing)
O23 - Service: OracleORAHOMEPagingServer - Unknown owner - c:\oracle/bin/pagntsrv.exe
O23 - Service: OracleORAHOMESNMPPeerEncapsulator - Unknown owner - c:\oracle\BIN\ENCSVC.EXE
O23 - Service: OracleORAHOMESNMPPeerMasterAgent - Unknown owner - c:\oracle\BIN\AGNTSVC.EXE
O23 - Service: OracleORAHOMETNSListener - Unknown owner - c:\oracle\BIN\TNSLSNR.exe
O23 - Service: OracleServiceCSI1 - Oracle Corporation - c:\oracle\bin\ORACLE.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - Unknown owner - C:\WINDOWS\System32\vmnetdhcp.exe (file missing)
  • 0

#4
loophole
Posted 17 September 2005 - 05:55 PM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Hello and welcome to Geeks to Go:tazz:

I see you have been infected by malware. Lets get you fixed up.
Please follow the directions as closely as you can . Lets begin

Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop.

Please Update Ewido

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

Now close all windows other than HiJackThis, then click Fix Checked.


Next, please reboot your computer in SafeMode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.
Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Run Ewido:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
  • When the scan is finished, click the Save report button at the bottom of the screen.
  • Save the report to your desktop
Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full system scan. Make sure the autoclean box is checked!
Save the scan log and post it along with a new HijackThis Log, the contents of the smitfiles.txt log and the Ewido Log by using Add Reply.
Let us know if any problems persist.
  • 0

#5
vicktory1955
Posted 19 September 2005 - 11:55 AM

vicktory1955

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
:tazz: Thank you so much! This is an awesome service to the online community.
Everything is working much better. I was able to get at least some of the security updates needed for windows. And that darn Norton virus window is gone!

I think I need to reset some start point for windows to go back to?

Also I could not seem to get Panda Active scan to run. My default browser is firefox and it needs to run in IE. It seems to hang up after a short time.

Here are the other logs:
Logfile of HijackThis v1.99.1
Scan saved at 10:46:14 AM, on 9/19/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Atievxx.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\PcNicCtl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\tp4serv.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\WINDOWS\System32\Atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\ltcm000c.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\Program Files\Common Files\Symantec Shared\SymTray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\GlobeSoft\MultiNetwork Manager 6\NT\MNMControl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\mozilla.org\Mozilla\Mozilla.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ORiNOCO\Client Manager\CmLUC.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\bob\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9
O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\Run: [MNM] "C:\Program Files\GlobeSoft\MultiNetwork Manager 6\NT\\MultiNetMgr.exe" -SysTray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lwinst Run Profiler] .\Lwtest.exe /detect /quiet /launch ".\Lwpevntm.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ORiNOCO Client Manager.lnk = C:\Program Files\ORiNOCO\Client Manager\CmLUC.exe
O4 - Global Startup: Shockwave Init.lnk = C:\WINDOWS\SYSTEM\MACROMED\Shockwave\SwInit.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1093634145369
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{62DB549F-6BC7-404F-903C-595CE43FD958}: Domain = crewsoft.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{62DB549F-6BC7-404F-903C-595CE43FD958}: NameServer = 198.232.247.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: Domain = crewsoft.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{23BE61A5-5D2B-4A9D-BD50-28473130F76E}: NameServer = 198.232.247.1
O20 - Winlogon Notify: mnmwlxchain - C:\WINDOWS\SYSTEM32\NTGlobeBTA.dll
O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: IntelPcNicCtl - Unknown owner - C:\WINDOWS\System32\PcNicCtl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - c:\oracle\bin\omtsreco.exe
O23 - Service: OracleORAHOMEAgent - Oracle Corporation - c:\oracle\bin\agntsrvc.exe
O23 - Service: OracleORAHOMEClientCache - Unknown owner - c:\oracle\BIN\ONRSD.EXE
O23 - Service: OracleORAHOMEHTTPServer - Unknown owner - c:\oracle\Apache\Apache\apache.exe" --ntservice (file missing)
O23 - Service: OracleORAHOMEPagingServer - Unknown owner - c:\oracle/bin/pagntsrv.exe
O23 - Service: OracleORAHOMESNMPPeerEncapsulator - Unknown owner - c:\oracle\BIN\ENCSVC.EXE
O23 - Service: OracleORAHOMESNMPPeerMasterAgent - Unknown owner - c:\oracle\BIN\AGNTSVC.EXE
O23 - Service: OracleORAHOMETNSListener - Unknown owner - c:\oracle\BIN\TNSLSNR.exe
O23 - Service: OracleServiceCSI1 - Oracle Corporation - c:\oracle\bin\ORACLE.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - Unknown owner - C:\WINDOWS\System32\vmnetdhcp.exe (file missing)

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 4:53:23 PM, 9/18/2005
+ Report-Checksum: F3B33785

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup
C:\Documents and Settings\bob\Cookies\bob@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.13:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.23:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.27:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.28:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.43:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.44:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.45:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.46:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.51:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup
:mozilla.52:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.53:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.54:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.55:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.79:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.80:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.81:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.82:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.83:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.84:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.87:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.88:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.101:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.102:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.103:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.124:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.142:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.143:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.151:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.163:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.164:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.178:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.179:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.180:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.183:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.184:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.185:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.186:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.187:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.196:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.197:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.198:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.200:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.227:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.228:C:\RECYCLER\NPROTECT\00060900.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.9:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.21:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.28:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.43:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.44:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.45:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.46:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.47:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.52:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup
:mozilla.53:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.54:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.55:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.56:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.80:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.81:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.82:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.85:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.86:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.96:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.97:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.98:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.121:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.139:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.140:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.148:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.160:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.161:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.175:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.176:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.177:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.180:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.181:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.182:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.183:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.184:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.193:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.194:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.195:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.197:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.224:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.225:C:\RECYCLER\NPROTECT\00060901.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.9:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.21:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.28:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.43:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.44:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.45:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.46:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.47:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.52:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup
:mozilla.53:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.54:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.55:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.56:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.80:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.81:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.82:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.85:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.86:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.96:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.97:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.98:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.121:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.139:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.140:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.148:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.160:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.161:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.175:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.176:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.177:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.180:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.181:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.182:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.183:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.184:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.193:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.194:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.195:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.197:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.224:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.225:C:\RECYCLER\NPROTECT\00060902.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.9:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.21:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.28:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.43:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.44:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.45:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.46:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.47:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.52:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup
:mozilla.53:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.54:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.55:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.56:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.80:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.81:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.82:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.85:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.86:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.96:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.97:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.98:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.121:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.139:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.140:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.148:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.160:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.161:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.175:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.176:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.177:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.180:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.181:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.182:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.183:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.184:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.193:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.194:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.195:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.197:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.224:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.225:C:\RECYCLER\NPROTECT\00060903.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.7:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.22:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.43:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.44:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.45:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.46:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.47:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.48:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.53:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup
:mozilla.54:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.55:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.56:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.57:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.81:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.82:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.83:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.86:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.87:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.97:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.98:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.101:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.122:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.140:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.141:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.149:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.161:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.162:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.176:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.177:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.178:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.181:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.182:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.183:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.184:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.185:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.194:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.195:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.196:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.198:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.225:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.226:C:\RECYCLER\NPROTECT\00060904.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.6:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.22:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.43:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.44:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.45:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.46:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.47:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.48:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.53:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Ad-logics : Cleaned with backup
:mozilla.54:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.55:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.56:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.57:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.81:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.82:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.83:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.86:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.87:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.97:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.98:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.101:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.122:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.140:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.141:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.149:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.161:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.162:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.176:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.177:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.178:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.181:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.182:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.183:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.184:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.185:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.194:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.195:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.196:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.198:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.225:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.226:C:\RECYCLER\NPROTECT\00060906.MOZ -> Spyware.Cookie.Googleadservices : Cleaned with backup


::Report End



smitRem log file
version 2.3

by noahdfear

The current date is: Sun 09/18/2005
The current time is: 13:23:45.67

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ShudderLTD key present! Running LTDFix!

ShudderLTD key was successfully removed! :)


Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

logfiles


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Wininet.dll ~~~

wininet.dll INFECTED!! :) Starting replacement procedure.


~~~~ Looking for C:\WINDOWS\system32\dllcache\wininet.dll ~~~~


~~~~ C:\WINDOWS\system32\dllcache\wininet.dll Present! ~~~~


~~~~ Checking dllcache\wininet.dll for infection ~~~~


~~~~ dllcache\wininet.dll Clean! ~~~~

~~~ Replaced wininet.dll from dllcache ~~~



~~~ Upon reboot ~~~

wininet.old present!
oleadm.dll not present!
oleext.dll not present!


~~~ Upon completion ~~~

wininet.old not present!
oleadm.dll not present!
oleext.dll not present!


~~~~ Rechecking C:\WINDOWS\system32\wininet.dll for infection ~~~~


~~~~ C:\WINDOWS\system32\wininet.dll Clean! :ph34r: ~~~~

Thanks again for your help!
:)
  • 0

#6
loophole
Posted 19 September 2005 - 02:56 PM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
disable and re-enable the Norton Protected Recycle Bin

1. On the desktop, right-click the Norton Protected Recycle Bin icon.
2. Click Properties.
3. On the Norton Protection tab, uncheck Enable Protection.
4. Click OK.
5. Restart the computer.
6. On the desktop, right-click the Recycle Bin icon.
7. Click Properties.
8. On the Norton Protection tab, check Enable Protection.
9. Click OK.
10. Restart your computer.

While it is disabled empty it

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

  • 0

#7
loophole
Posted 03 October 2005 - 11:22 PM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP