[PLAYBOY80]

Logfile of HijackThis v1.99.1
Scan saved at 2:21:18 AM, on 9/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apache Group\Apache\Apache.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 66.197.153.197 idenupdate.motorola.com #webjal auth
O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\awtsp.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O20 - Winlogon Notify: awtsp - C:\WINDOWS\System32\awtsp.dll
O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE

[Advertisements]

Hi Playboy80, welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your problem.

Please print these instructions out for use in Safe Mode.

Also note, one must be either logged in under the Administrator account or have administrator privileges to be able to successfully complete these procedures

1. Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please REBOOT your computer into Safe Mode.
  
  You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
  
  
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning and a list of forums to seek help at.
  it should look like this
  

  VundoFix V2.1 by Atri
  By pressing enter you agree that you are using this at your own risk
  Please seek assistance at one of the following forums:
  http://www.atribune.org/forums
  http://www.247fixes.com/forums
  http://www.geekstogo.com/forum
  http://forums.net-integration.net
  

• At this point press enter one time.
  
• Next you will see:
  

  Type in the filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  
  • C:\WINDOWS\System32\awtsp.dll
  
  
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  
• Next you will see:
  

  Please type in the second filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  C:\WINDOWS\System32\pstwa.*
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.

2. The fix will run then HijackThis will open.

• In HiJackThis, please place a check next to the following items and click FIX CHECKED:
  
  
  • O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\awtsp.dll
    O20 - Winlogon Notify: awtsp - C:\WINDOWS\System32\awtsp.dll
  
  
• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
• Once your machine reboots please continue with the instructions below.

3. Download and install CleanUp!

• Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• Set the program up as follows:
• Click "Options..."
• Move the arrow down to "Custom CleanUp!"
• Put a check next to the following (Make sure nothing else is checked!):
• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users

[*]Click OK
[*]Press the CleanUp! button to start the program.
[*]It may ask you to reboot at the end, click NO.
[/list]4. Please run this online virus scan: ActiveScan
Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder into this topic.
Regards,

Trevuren

[Trevuren]

Hi Playboy80, welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your problem.

Please print these instructions out for use in Safe Mode.

Also note, one must be either logged in under the Administrator account or have administrator privileges to be able to successfully complete these procedures

1. Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please REBOOT your computer into Safe Mode.
  
  You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
  
  
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning and a list of forums to seek help at.
  it should look like this
  

  VundoFix V2.1 by Atri
  By pressing enter you agree that you are using this at your own risk
  Please seek assistance at one of the following forums:
  http://www.atribune.org/forums
  http://www.247fixes.com/forums
  http://www.geekstogo.com/forum
  http://forums.net-integration.net
  

• At this point press enter one time.
  
• Next you will see:
  

  Type in the filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  
  • C:\WINDOWS\System32\awtsp.dll
  
  
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  
• Next you will see:
  

  Please type in the second filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  C:\WINDOWS\System32\pstwa.*
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.

2. The fix will run then HijackThis will open.

• In HiJackThis, please place a check next to the following items and click FIX CHECKED:
  
  
  • O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\awtsp.dll
    O20 - Winlogon Notify: awtsp - C:\WINDOWS\System32\awtsp.dll
  
  
• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
• Once your machine reboots please continue with the instructions below.

3. Download and install CleanUp!

• Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• Set the program up as follows:
• Click "Options..."
• Move the arrow down to "Custom CleanUp!"
• Put a check next to the following (Make sure nothing else is checked!):
• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users

[*]Click OK
[*]Press the CleanUp! button to start the program.
[*]It may ask you to reboot at the end, click NO.
[/list]4. Please run this online virus scan: ActiveScan
Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder into this topic.
Regards,

Trevuren

[PLAYBOY80]

Thank you for the help but its still there whats the next move? below is the active scan, hijack log and the vundo fix text.


Incident Status Location

Spyware:Spyware/Virtumonde No disinfected C:\backups\backup-20050915-013244-104.dll
Spyware:Spyware/Virtumonde No disinfected C:\backups\backup-20050915-013300-645.dll
Spyware:Spyware/Virtumonde No disinfected C:\backups\backup-20050915-013527-734.dll
Spyware:Spyware/Virtumonde No disinfected C:\backups\backup-20050915-013536-878.dll
Spyware:Spyware/Virtumonde No disinfected C:\backups\backup-20050915-013737-467.dll
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\285.jar-2e764d53-65a6ca3c.zip[Bubble.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\285.jar-2e764d53-65a6ca3c.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\285.jar-2e764d53-65a6ca3c.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\a.jar-33242f5b-6fb5f65f.zip[a.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\a.jar-33242f5b-6fb5f65f.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\a.jar-33242f5b-6fb5f65f.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-1f8b980f-309310ed.zip[Gummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-1f8b980f-309310ed.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-1f8b980f-309310ed.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-1f8b980f-309310ed.zip[Beyond.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-de1f110-28cc94eb.zip[Gummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-de1f110-28cc94eb.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-de1f110-28cc94eb.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-1946ff78-62c910e0.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-1946ff78-62c910e0.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-1946ff78-62c910e0.zip[Gummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-1946ff78-62c910e0.zip[Beyond.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-1946ff78-62c910e0.zip[Worker.class]
Virus:Trj/Downloader.NO Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-1946ff78-62c910e0.zip[web.exe]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7ea67-5fcaccd1.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7ea67-5fcaccd1.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7ea67-5fcaccd1.zip[Gummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7ea67-5fcaccd1.zip[Beyond.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7ea67-5fcaccd1.zip[Worker.class]
Virus:Trj/Downloader.ANL Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7ea67-5fcaccd1.zip[WEB.EXE]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7f9b4-60c80842.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7f9b4-60c80842.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7f9b4-60c80842.zip[Gummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7f9b4-60c80842.zip[Beyond.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7f9b4-60c80842.zip[Worker.class]
Virus:Trj/Downloader.ON Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-3bf7f9b4-60c80842.zip[web.exe]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-c7b45c4-68d38a97.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-c7b45c4-68d38a97.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-c7b45c4-68d38a97.zip[Gummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-c7b45c4-68d38a97.zip[Beyond.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-c7b45c4-68d38a97.zip[Worker.class]
Adware:Adware/CWS.Yexe No disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-c7b45c4-68d38a97.zip[web.exe]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-487b52a0-2b8e445c.zip[BlackBox.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-487b52a0-2b8e445c.zip[VBUG.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-487b52a0-2b8e445c.zip[Dummy.class]
Adware:Adware/Startpage.JU No disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-487b52a0-2b8e445c.zip[Beyond.class]
Virus:Trj/Downloader.NF Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-487b52a0-2b8e445c.zip[rundll32.exe]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-1d99185b.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-1d99185b.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-1d99185b.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-1d99185b.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-31dd7582.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-31dd7582.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-31dd7582.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-31dd7582.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-4abb1b2e.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-4abb1b2e.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-4abb1b2e.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-4abb1b2e.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-52b8960f.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-52b8960f.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-52b8960f.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-52b8960f.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-69fcc0fd.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-69fcc0fd.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-69fcc0fd.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-69fcc0fd.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-7b3a0240.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-7b3a0240.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-7b3a0240.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-7b3a0240.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-7c877fc7.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-7c877fc7.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-7c877fc7.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-7c877fc7.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f5b6b54-16b36ac7.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f5b6b54-16b36ac7.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f5b6b54-16b36ac7.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f5b6b54-16b36ac7.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f5b6b54-5104db80.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f5b6b54-5104db80.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f5b6b54-5104db80.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f5b6b54-5104db80.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f8050ce-61d5a361.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f8050ce-61d5a361.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f8050ce-61d5a361.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-1f8050ce-61d5a361.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-25c13e55-615b5f22.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-25c13e55-615b5f22.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-25c13e55-615b5f22.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-25c13e55-615b5f22.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2dd0698-3891b11a.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2dd0698-3891b11a.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2dd0698-3891b11a.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2dd0698-3891b11a.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-5bde0eb6-1b1d14df.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-5bde0eb6-1b1d14df.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-5bde0eb6-1b1d14df.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-5bde0eb6-1b1d14df.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d196ab5-31b47ea6.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d196ab5-31b47ea6.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d196ab5-31b47ea6.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d196ab5-31b47ea6.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7eb4d059-3ac6ec24.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7eb4d059-3ac6ec24.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7eb4d059-3ac6ec24.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7eb4d059-3ac6ec24.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-a5b55c7-6f45c155.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-a5b55c7-6f45c155.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-a5b55c7-6f45c155.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-a5b55c7-6f45c155.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\clsld.jar-49a517fa-196d2080.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\clsld.jar-49a517fa-196d2080.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\clsld.jar-49a517fa-196d2080.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\clsld.jar-49a517fa-196d2080.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-6f603a77-45d8a677.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jar-6c0f7aaf-5929941b.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jar-7271642a-7af3c78c.zip[counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jar-7271642a-7af3c78c.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jar-7271642a-7af3c78c.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jar-7271642a-7af3c78c.zip[Beyond.class]
Adware:Adware/IST.ISTBar No disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-4514e5ea-79c2de76.zip[InstallerApplet.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv124.jar-7b537c95-5582afa5.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv124.jar-7b537c95-5582afa5.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv124.jar-7b537c95-5582afa5.zip[Matrix.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv124.jar-7b537c95-5582afa5.zip[Parser.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv252.jar-30a4b1ae-74596263.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv252.jar-30a4b1ae-74596263.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv252.jar-30a4b1ae-74596263.zip[Matrix.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv252.jar-30a4b1ae-74596263.zip[Parser.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv292.jar-3778142a-29bfe168.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv292.jar-3778142a-29bfe168.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv292.jar-3778142a-29bfe168.zip[Matrix.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv292.jar-3778142a-29bfe168.zip[Parser.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv420.jar-19cdd09a-5c6f721c.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv420.jar-19cdd09a-5c6f721c.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv420.jar-19cdd09a-5c6f721c.zip[Matrix.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv420.jar-19cdd09a-5c6f721c.zip[Parser.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv505.jar-47cfdd92-1a412cb5.zip[Matrix.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv505.jar-47cfdd92-1a412cb5.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv505.jar-47cfdd92-1a412cb5.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv505.jar-47cfdd92-1a412cb5.zip[Parser.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv80.jar-1887932a-772b333d.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv80.jar-1887932a-772b333d.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv80.jar-1887932a-772b333d.zip[Matrix.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv80.jar-1887932a-772b333d.zip[Parser.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\m_st_jv.jar-59fb7d6e-5b9356b9.zip[Bubble.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\m_st_jv.jar-59fb7d6e-5b9356b9.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\m_st_jv.jar-59fb7d6e-5b9356b9.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nbb2.jar-3ba8fb30-47c9e74b.zip[Beyond.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nbb2.jar-3ba8fb30-47c9e74b.zip[counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nbb2.jar-3ba8fb30-47c9e74b.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\nbb2.jar-3ba8fb30-47c9e74b.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\playup_pst03.jar-71fe9341-47b89b89.zip[Bubble.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\playup_pst03.jar-71fe9341-47b89b89.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\playup_pst03.jar-71fe9341-47b89b89.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\sheeb\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3daa24a3-6cfbb01d.zip[BlackBox.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\sheeb\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3daa24a3-6cfbb01d.zip[VB.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\sheeb\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3daa24a3-6cfbb01d.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\sheeb\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3daa24a3-6cfbb01d.zip[Beyond.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\sheeb\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d9192de-36060564.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\sheeb\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d9192de-36060564.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\sheeb\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d9192de-36060564.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\sheeb\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d9192de-36060564.zip[Installer.class]
Adware:adware/gator No disinfected C:\GatorPatch.log
Adware:adware/superspider No disinfected C:\m.exe
Adware:adware/cws.searchmeup No disinfected C:\new.exe
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\hjt\backups\backup-20050915-043230-537.dll
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\hjt\backups\backup-20050915-051144-471.dll
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\hjt\backups\backup-20050915-051205-466.dll
Spyware:Spyware/Virtumonde No disinfected C:\Program Files\hjt\backups\backup-20050915-051708-269.dll
Adware:adware/cws.bootconf No disinfected C:\WINDOWS\default.css
Adware:adware/msxmidi No disinfected C:\WINDOWS\msxmidi.exe
Spyware:Spyware/Virtumonde No disinfected C:\WINDOWS\system32\awtsp.dll
Virus:Backdoor Program Disinfected C:\WINDOWS\system32\ClrSchP012.dll
Virus:Backdoor Program Disinfected C:\WINDOWS\system32\ClrSchP012.dlltmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\system32\cm1.dll

[PLAYBOY80]

heres activescan cont.


Virus:Trj/Downloader.ABR Disinfected C:\WINDOWS\system32\pcpvcn.dll
Adware:Adware/KeenValue No disinfected C:\WINDOWS\system32\setup_incred_9.exe
Adware:Adware/Startpage.PH No disinfected C:\WINDOWS\system32\shdocpe.dll
Virus:Trj/Downloader.ABR Disinfected C:\WINDOWS\system32\trdocert.dll
Adware:Adware/MyWay No disinfected C:\WINDOWS\system32\Xcite.dll
Adware:Adware/nCase No disinfected C:\WINDOWS\system32
\Xcite.exe

the hijackthis file


Logfile of HijackThis v1.99.1
Scan saved at 10:22:51 AM, on 9/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 66.197.153.197 idenupdate.motorola.com #webjal auth
O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\awtsp.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O20 - Winlogon Notify: awtsp - C:\WINDOWS\System32\awtsp.dll
O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE

[PLAYBOY80]

and vundofix


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Suspending PID 148 'smss.exe'
Threads [152]Error 0x6 : The handle is invalid.

[156]Error 0x6 : The handle is invalid.

[160]Error 0x6 : The handle is invalid.



Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 716 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Error, Cannot find a process with an image name of rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 220 'winlogon.exe'
Error 0x6 : The handle is invalid.

Could not delete file.
Files Deleted sucessfully.

[Trevuren]

The fix will not work if you are not logged in as administrator or if you don't have administrator privileges.



Trevuren

[Trevuren]

Before retrying the fix, I suggest the folllowing :

We need to do a general overall cleanup of your system at this time

1.Download and Run a free trial version of an anti-trojan program called Trojan Hunter: HERE

• Let it scan your whole system and remove anything it finds.
  
• REBOOT your system.

2. Run Panda, a free online antivirus scan from HERE

• Let it remove anything it finds.
  
• REBOOT your system.

3. Download, install, update, configure, and run Ad-Aware SE Personal 1.06.

• Download Ad-Aware SE Personal 1.06:
  • Download Ad-Aware SE Personal 1.05.
  • Save aawsepersonal.exe to a convenient location.
• Install Ad-Aware SE Personal 1.06:
  • Double-click on aawsepersonal.exe to install the program.
  • Follow the default settings for installation.
  • After the program has finished installing uncheck the "Perform a full system scan now", "Update definition file now", and "Open the help file now" boxes.
• Update Ad-Aware SE Personal 1.06:
  • Double-click the Ad-Aware SE Personal icon on your desktop.
  • Click "Check for updates now" then click "Connect".
  • It will check for any updates. If any are found click "OK" to download and install the updates. Once it has finished click "Finish".
• Configure Ad-Aware SE Personal 1.06:
  • Click on the Gear button at the top of the window.
  • Click "General" on the left hand side to display the General Settings box.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
      • "Automatically save logfile"
      • "Automatically quarantine objects prior to removal"
      • "Safe Mode (always request confirmation)"
      • "Prompt to update outdated definitions" - change to 7 days from the default 14.
  • Click "Scanning" on the left hand side to display the Scan Settings box.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
    • "Scan within archives"
    • "Select drives & folders to scan" - select your hard drive(s).
    • "Scan active processes"
    • "Scan registry"
    • "Deep-scan registry"
    • "Scan my IE favorites for banned URLs"
    • "Scan my Hosts file"
  • Click "Advanced" on the left hand side to display the Advanced Settings box.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
    • "Move deleted files to Recycle Bin"
    • "Include additional object information"
    • "Include negligible objects information"
    • "Include environment information"
  • Click "Defaults" on the left hand side to display the Default Settings box.
    • Make sure these items have your preferred settings in them.:
    • "Default homepage"
    • "Default searchpage"
  • Click "Tweak" on the left hand side to display the Tweak Settings box.
    • Click the + (plus) sign next to the Log Files section. This will expand the section.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
      • "Include basic Ad-Aware settings in log file"
      • "Include additional Ad-Aware settings in log file"
      • "Include reference summary in log file"
      • "Include alternate data stream details in log file"
    • Click the + (plus) sign next to the Scanning Engine section. This will expand the section.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
      • "Unload recognized processes & modules during scan"
      • "Scan registry for all users instead of current user only"
      • "Obtain command line of scanned processes"
    • Click the + (plus) sign next to the Cleaning Engine section. This will expand the section.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
      • "Always try to unload modules before deletion"
      • "During removal, unload Explorer and IE if necessary"
      • "Let Windows remove files in use at next reboot"
      • "Delete quarantined objects after restoring"
  • Once you are done with these settings, click "Proceed" to save them.
  • This will take you back to the main screen.
• Run Ad-Aware SE Personal 1.06:
  • Click the "Start" button.
  • Uncheck the "Search for negligible risk entries" entry.
  • Choose the "Use custom scanning options" scan mode.
  • Click the "Next" button.
  • Ad-Aware will begin to scan for malware residing on your computer.
  • Allow the scan to finish.
  • Right-click on any entry in the list and click "Select All" to select the whole list.
  • Click "Next" and choose "OK" at the prompt to quarantine and remove the objects.
  • REBOOT your system.

4. Download the .exe format of Cleanup by Steven Gould from :HERE

• A window will open and choose SAVE, then DESKTOP as the destination.
  
• On your Desktop, click on Cleanup40.exe icon.
  
• Then, click RUN and place a checkmark beside "I Agree"
  
• Then click NEXT followed by START and OK.
  
• A window will appear with many choices, keep all the defaults as set when the Slide Bar to the left is set to Standard Quality.
  
• Click OK
  
• Finally click "CleanUp"

The program with probably ask you to reboot. If it doesn't, then REBOOT your system yourself.

5. Finally, run HijackThis, click SCAN, produce a LOG and POST it in this thread for review.

Regards,

Trevuren

[PLAYBOY80]

Logfile of HijackThis v1.99.1
Scan saved at 5:22:36 PM, on 9/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\FIREWALL\PNMSRV.EXE
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE
C:\WINDOWS\System32\lexpps.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe
C:\Program Files\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 66.197.153.197 idenupdate.motorola.com #webjal auth
O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\awtsp.dll (file missing)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: awtsp - C:\WINDOWS\System32\awtsp.dll (file missing)
O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\FIREWALL\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

[Trevuren]

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

• First we need to make all files and folders VISIBLE:
  
  • Go to start>control panel>folder options>view (tab)
  • Choose to "show hidden files and folders,"
  • Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
  • Close the window with ok
• Please RUN HijackThis.
  . Click the SCAN button to produce a log.
  
  
• Place a check mark beside each one of the following items:
  
  O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\awtsp.dll (file missing)
  O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
  O20 - Winlogon Notify: awtsp - C:\WINDOWS\System32\awtsp.dll (file missing)
  
  
  
• Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
  
  
• Reboot Your System in Safe Mode
  
  How to use the F8 method to Start Your Computer in Safe Mode
  
  
  • Restart the computer.
  • As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
  • Use the arrow keys to select the Safe mode menu item
  • Press Enter.
• Using Windows Explorer, locate the following files/folders, and DELETE them (if they are present):
  
  C:\WINDOWS\SYSTEM32\avldr.dll
  
  
• Exit Explorer, and REBOOT BACK INTO NORMAL MODE
  
  
• Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everything looks now.

Regards,

Trevuren

[PLAYBOY80]

Logfile of HijackThis v1.99.1
Scan saved at 1:48:20 AM, on 9/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\FIREWALL\PNMSRV.EXE
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 66.197.153.197 idenupdate.motorola.com #webjal auth
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE


everything appears to be okay! thank you. i Would like to donate is there a specific amount you guys accept or just what ever i can spare?

[Trevuren]

PlayBoy 80, you are under no obligation whatsoever to make any donation. If you are able to, any amount would be greatly appreciated and would go to getting my machine fixed/replaced as it is starting to show wear and tear after so many logs.

Congratulations, your log shows that your SYSTEM IS CLEAN

There are a few things you must do once you are completely clean:

1. Re-hide your System Files and Folders to prevent any future accidents.

Reconfigure Windows XP to hide hidden files:

• Click Start. Open My Computer.
• Select the Tools menu and click Folder Options. Select the View Tab.
  
• Under the Hidden files and folders heading deselect "Show hidden files and folders".
• Check the "Hide protected operating system files (recommended)" option.
• Click Yes to confirm. Click OK.

2. Reset and Re-enable your System Restore to remove bad files from the backup that Windows makes as no program is able to clean those files:

TO DISABLE SYSTEM RESTORE

• Right-click "My Computer", and then left click "Properties".
• Left click on "System Restore Tab"
• Check box beside "Turn Off System Restore"
• Left click on "Apply"

TO ENABLE SYSTEM RESTORE

• Remove check mark from "Turn Off System Restore"
• Click on "Apply"

Here are some tips to reduce the potential for spyware infection in the future:

Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

To protect yourself further:

• Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.

And also see TonyKlein's good advice
So how did I get infected in the first place? (My Favorite)

Regards,

Trevuren

[Trevuren]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.