[sallen]

Hi,

My system is infected with aurora adware (and maybe some other malware as well).
I was wondering if someone could help me out.
Thanks in advance.
Stephen


My hijackthis log is:
Logfile of HijackThis v1.99.1
Scan saved at 23:03:24, on 23/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Creative\Creative Desktop Wireless\KbDriver_2K.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\MUSTEK 1248UB\Driver\WATCH.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\steve1\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://gmeemjxvdkfah...Lw_6lvWsaQ.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {12AD9BF1-8D58-3E0D-800F-FD9A191E2F99} - C:\DOCUME~1\steve1\APPLIC~1\SECTUP~1\DogData.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nsnuf] C:\WINDOWS\nsnuf.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NastySex] C:\WINDOWS\NastySex.exe -n
O4 - HKLM\..\Run: [KeyBoardDriver] C:\Program Files\Creative\Creative Desktop Wireless\KbDriver_2K.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 1)" /O6 "USB002" /M "Stylus C46"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 2)" /O6 "USB003" /M "Stylus C46"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Dumb For Cake Beep] C:\Documents and Settings\All Users.WINDOWS\Application Data\nameforkdumbfor\POLL CLOCK.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [forkblue] C:\DOCUME~1\steve1\APPLIC~1\PINGSI~1\Error Pile Sign.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: raid_tool.exe.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Watch.lnk = C:\Program Files\MUSTEK 1248UB\Driver\WATCH.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec....sa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec....sa/SymAData.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[Advertisements]

Please read completely through the instructions below and download the files from the links provided. You may want to save or print out these instructions for easier reference.

First, download ewido security suite.

Next, download Lavasoft's Ad-Aware and the VX2 Cleaner Plug-in. Install Ad-Aware using the default options, then install vx2cleaner_inst.exe, taking all the defaults there as well.

Run Ad-Aware, update to the latest definitions, then click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK", then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.

Reboot your PC and run Ad-Aware again. This time, click on the Start button in Ad-Aware, select "Perform smart system scan" and click Next. Once the scan finishes, click "Next" again. Select all objects found (right click anywhere in the list of found objects and click "Select All Objects"). Click "Next" one more time, then "OK" to confirm the removal.

You will be prompted to set Ad-Aware to run on reboot, click "OK". Exit Ad-Aware and restart your PC once again.

When Ad-Aware starts up, click on "Start", then "Next". Follow the steps above if anything is found, or click "Finish", then exit Ad-Aware.

For a final cleanup, please install and run Ewido.

• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
• From the main ewido screen, click on update in the left menu, then click the Start update button.
• After the update finishes (the status bar at the bottom will display "Update successful")
• Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
• If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.
• When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Please rebooting your system once more.

Run Panda's online virus scan and perform a full system scan: Panda ActiveScan

Save the scan log and post it along with a new HijackThis Log, and the log from the Ewido scan in your next reply.

[didom]

Please read completely through the instructions below and download the files from the links provided. You may want to save or print out these instructions for easier reference.

First, download ewido security suite.

Next, download Lavasoft's Ad-Aware and the VX2 Cleaner Plug-in. Install Ad-Aware using the default options, then install vx2cleaner_inst.exe, taking all the defaults there as well.

Run Ad-Aware, update to the latest definitions, then click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK", then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.

Reboot your PC and run Ad-Aware again. This time, click on the Start button in Ad-Aware, select "Perform smart system scan" and click Next. Once the scan finishes, click "Next" again. Select all objects found (right click anywhere in the list of found objects and click "Select All Objects"). Click "Next" one more time, then "OK" to confirm the removal.

You will be prompted to set Ad-Aware to run on reboot, click "OK". Exit Ad-Aware and restart your PC once again.

When Ad-Aware starts up, click on "Start", then "Next". Follow the steps above if anything is found, or click "Finish", then exit Ad-Aware.

For a final cleanup, please install and run Ewido.

• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
• From the main ewido screen, click on update in the left menu, then click the Start update button.
• After the update finishes (the status bar at the bottom will display "Update successful")
• Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
• If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.
• When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Please rebooting your system once more.

Run Panda's online virus scan and perform a full system scan: Panda ActiveScan

Save the scan log and post it along with a new HijackThis Log, and the log from the Ewido scan in your next reply.

[sallen]

Thank you for for getting back to me so quickly.
The requested reports are shown below:

1. This is the Ewido report:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 21:15:56, 24/09/2005
+ Report-Checksum: 340BE764

+ Scan result:

:mozilla.7:C:\Documents and Settings\steve1\Application Data\Mozilla\Firefox\Profiles\e4r2vepe.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.8:C:\Documents and Settings\steve1\Application Data\Mozilla\Firefox\Profiles\e4r2vepe.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.10:C:\Documents and Settings\steve1\Application Data\Mozilla\Firefox\Profiles\e4r2vepe.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.24:C:\Documents and Settings\steve1\Application Data\Mozilla\Firefox\Profiles\e4r2vepe.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.26:C:\Documents and Settings\steve1\Application Data\Mozilla\Firefox\Profiles\e4r2vepe.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Documents and Settings\steve1\Cookies\steve1@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup


::Report End

2. This is the Panda ActiveScan report:

Incident Status Location

Adware:Adware/Lop No disinfected C:\DOCUME~1\steve1\APPLIC~1\SECTUP~1\DogData.exe
Adware:Adware/Lop No disinfected c:\docume~1\steve1\locals~1\temp\qgzofsgk.exe
Adware:adware/lop No disinfected C:\PROGRAM FILES\C2Media
Adware:adware/otx No disinfected Windows Registry
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users.WINDOWS\Application Data\nameforkdumbfor\POLL CLOCK.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\steve1\Application Data\ping site wait\ehyzztiw.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\steve1\Application Data\ping site wait\Error Pile Sign.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\steve1\Application Data\ping site wait\For grim trust.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\steve1\Application Data\ping site wait\Mapi Axis Win Upload.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\steve1\Application Data\SECT UP DART\DogData.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\steve1\Local Settings\Temp\mipyxetu.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\steve1\Local Settings\Temp\qgzofsgk.exe

3. This is the HiJack This Log:
Logfile of HijackThis v1.99.1
Scan saved at 22:43:12, on 24/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Creative\Creative Desktop Wireless\KbDriver_2K.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\MUSTEK 1248UB\Driver\WATCH.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\steve1\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sgysypgqj...Lw_6lvWsaQ.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {12AD9BF1-8D58-3E0D-800F-FD9A191E2F99} - C:\DOCUME~1\steve1\APPLIC~1\SECTUP~1\DogData.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nsnuf] C:\WINDOWS\nsnuf.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NastySex] C:\WINDOWS\NastySex.exe -n
O4 - HKLM\..\Run: [KeyBoardDriver] C:\Program Files\Creative\Creative Desktop Wireless\KbDriver_2K.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 1)" /O6 "USB002" /M "Stylus C46"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 2)" /O6 "USB003" /M "Stylus C46"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Dumb For Cake Beep] C:\Documents and Settings\All Users.WINDOWS\Application Data\nameforkdumbfor\POLL CLOCK.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [forkblue] C:\DOCUME~1\steve1\APPLIC~1\PINGSI~1\Error Pile Sign.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: raid_tool.exe.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Watch.lnk = C:\Program Files\MUSTEK 1248UB\Driver\WATCH.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec....sa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec....sa/SymAData.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thanks once again for you help with these problems.

Stephen

[didom]

Scan again with HijackThis and check the following items:

O4 - HKLM\..\Run: [nsnuf] C:\WINDOWS\nsnuf.exe
O4 - HKLM\..\Run: [NastySex] C:\WINDOWS\NastySex.exe -n
O4 - HKLM\..\Run: [Dumb For Cake Beep] C:\Documents and Settings\All Users.WINDOWS\Application Data\nameforkdumbfor\POLL CLOCK.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [forkblue] C:\DOCUME~1\steve1\APPLIC~1\PINGSI~1\Error Pile Sign.exe

After checking these items, close all browser windows except HijackThis and click "Fix checked".

Make sure all hidden files and folders are visible (Instructions )
Reboot your computer into safe mode (Instructions)

Find and delete these files and folders (if they are still there):
Files:
C:\WINDOWS\nsnuf.exe
C:\WINDOWS\NastySex.exe
c:\docume~1\steve1\locals~1\temp\qgzofsgk.exe
C:\Documents and Settings\steve1\Local Settings\Temp\mipyxetu.exe
C:\Documents and Settings\steve1\Local Settings\Temp\qgzofsgk.exe

Folders:
C:\PROGRAM FILES\C2Media
C:\Documents and Settings\All Users.WINDOWS\Application Data\nameforkdumbfor
C:\Documents and Settings\steve1\Application Data\ping site wait
C:\Documents and Settings\steve1\Application Data\SECT UP DART

Go to start > run and type: cleanmgr and click ok.
Let it scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
Press OK to remove them.

Reboot your computer back into normal mode.

Run Panda's online virus scan and perform a full system scan: Panda ActiveScan

Save the scan log and post it along with a new HijackThis Log in your next reply.

Edited by didom, 25 September 2005 - 05:44 AM.

[sallen]

As requested the two logs are below:

This is the Panda ActiveScan log:

Incident Status Location

Adware:adware/otx No disinfected Windows Registry
Adware:Adware/Lop No disinfected C:\Documents and Settings\steve1\Local Settings\Temp\vfwjgual.exe


This is the Hijack This Log:

Logfile of HijackThis v1.99.1
Scan saved at 18:21:25, on 26/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Creative\Creative Desktop Wireless\KbDriver_2K.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\MUSTEK 1248UB\Driver\WATCH.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\steve1\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sgysypgqj...Lw_6lvWsaQ.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {12AD9BF1-8D58-3E0D-800F-FD9A191E2F99} - C:\DOCUME~1\steve1\APPLIC~1\SECTUP~1\DogData.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KeyBoardDriver] C:\Program Files\Creative\Creative Desktop Wireless\KbDriver_2K.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 1)" /O6 "USB002" /M "Stylus C46"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 2)" /O6 "USB003" /M "Stylus C46"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: raid_tool.exe.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Watch.lnk = C:\Program Files\MUSTEK 1248UB\Driver\WATCH.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec....sa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec....sa/SymAData.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thank you for you continuing help
Stephen

[didom]

Scan again with HijackThis and check the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sgysypgqj...Lw_6lvWsaQ.html
O2 - BHO: (no name) - {12AD9BF1-8D58-3E0D-800F-FD9A191E2F99} - C:\DOCUME~1\steve1\APPLIC~1\SECTUP~1\DogData.exe (file missing)

After checking these items, close all browser windows except HijackThis and click "Fix checked".


Download CCleaner and install it. (Please do not run the CCleaner utility yet.)
Start CCleaner, click Run CCleaner (bottom right)

Please follow the instructions provided, you may want to print out these instructions and use them as a reference.


Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display ("Update successful")

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Once the updates are installed do the following:

Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.
Run Ewido:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• You will be prompted to clean the first infection.
• Select "Perform action on all infections", then proceed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

Close ewido security suite.

Reboot into normal mode.

Then, please run this online virus scan: Panda ActiveScan

Save the scan log and post it along with a new HijackThis Log and the Ewido log in your next reply.

[sallen]

Hi,

The new logs are:

1. The Panda ActiveScan Log

Incident Status Location

Adware:adware/otx No disinfected Windows Registry

2. The HiJack This log

Logfile of HijackThis v1.99.1
Scan saved at 14:41:54, on 28/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Creative\Creative Desktop Wireless\KbDriver_2K.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\MUSTEK 1248UB\Driver\WATCH.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\steve1\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KeyBoardDriver] C:\Program Files\Creative\Creative Desktop Wireless\KbDriver_2K.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 1)" /O6 "USB002" /M "Stylus C46"
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 2)" /O6 "USB003" /M "Stylus C46"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: raid_tool.exe.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Watch.lnk = C:\Program Files\MUSTEK 1248UB\Driver\WATCH.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec....sa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec....sa/SymAData.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

3. The Ewido Log

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 13:46:32, 28/09/2005
+ Report-Checksum: D1C65218

+ Scan result:

No infected objects found.


::Report End

Thanks once again.
Stephen

[didom]

Download the Registry Search Tool.

• Unzip the contents of RegSrch.zip to a convenient location.
• Double-click on RegSrch.vbs.
• If you have an anti-virus installed it might prompt you about a running script. Please ignore this warning and allow the script to run.
• In the "Enter search string (case insensitive) and click OK..." box paste this string:
  • otx
• Click "OK" to search the registry for that string.
• Wait for a few minutes while it completes the search.
• Click "OK" to open the results in WordPad.
• Copy and paste the entire results into your next post.

[sallen]

The results from NotePad are:
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "otx" 28/09/2005 16:17:30

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\RealNetworks\RealPlayer\6.0\Preferences\PluginHandlerData\PluginInfo0]
@="{ComponentName~Shttp://ns.real.com/gemini.v1:RJBCDPlaylistActor~PluginFilename~Scdpl3210.dll~ComponentCLSID~X2m05y6oCY025CKOjyrBGKQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:nativecdplaylist~PluginFilename~Scdpl3210.dll~ComponentCLSID~XbrLR4XkiHEKGwl7pOqTgNA==}{ComponentName~Shttp://ns.real.com/gemini.v1:nativecdmanager~PluginFilename~Scdpl3210.dll~ComponentCLSID~XEr90jxVpo0qQD+HYBtyRxQ==}{PluginFilename~Scdpl3210.dll~ComponentCLSID~XtQQjowfr2kOjeHZ0w2HcyA==}{PluginFilename~Scdpl3210.dll~ComponentCLSID~Xm6G5FMQmXEeyLw3WlCY5Rw==}{PluginFilename~Scdpl3210.dll~ComponentCLSID~XtzXzfqQTe0OUi06+vvRXRw==}{PluginFilename~Scdpl3210.dll~ComponentCLSID~XrRqchZEgqU+RVL11ZQ/voA==}{PluginFilename~Sembd3260.dll~ComponentCLSID~XYECIN3SoaUWbf9utVc9RvA==}{PluginFilename~Sfftr3210.dll~ComponentCLSID~XOq2XjEIY/UOGiP3QFd8Lsw==}{PluginFilename~Sfftr3210.dll~ComponentCLSID~XVf2jqauBrkueHUaboHZy5g==}{PluginFilename~Sfftr3210.dll~ComponentCLSID~XJtL6R1rcwE+zatOK7KDRAA==}{PluginFilename~Sfftr3210.dll~ComponentCLSID~XZwzCsTMVCE2JmqsmFVPMPw==}{PluginFilename~Sfftr3210.dll~ComponentCLSID~XzU2Vlo695EKsga8ND2+RCA==}{PluginFilename~Sierpplug.dll~ComponentCLSID~Xgk2k/5cD80GxEj2ESjGkGQ==}{PluginFilename~SMPACore.dll~ComponentCLSID~XTIeB1un6C0SkzU5aFUzQBQ==}{PluginFilename~SMPACore.dll~ComponentCLSID~XaJ9iA9ibNku5ULu6iagNsg==}{PluginFilename~SMPACore.dll~ComponentCLSID~XW/Gklg1K00KUk2X9MILGWw==}{PluginFilename~SMPACore.dll~ComponentCLSID~X7UeU47oHb0iNbPD0hgngWg==}{PluginFilename~SMPACore.dll~ComponentCLSID~X9+vCVNJpAEuC+623SguaQQ==}{PluginFilename~Smpazip.dll~ComponentCLSID~XK0V1j1ZIJEKwBvXckL7h6Q==}{ComponentName~Shttp://ns.real.com/gemini.v1:rpdeviceview~PluginFilename~Smyde3260.dll~ComponentCLSID~X5GiQDa0ao0Gs9iLssf3MTA==}{ComponentName~Shttp://ns.real.com/gemini.v1:devicemanageractor~PluginFilename~Smyde3260.dll~ComponentCLSID~XOqI9+/PM80mss6lx5vcD6g==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XjBGZEfdM0UmyTx5QUSTe1g==}{PluginFilename~Smyde3260.dll~ComponentCLSID~X8eMDLO12iUmhgMY/h5bXmw==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XVUdeP4id/UW26YasicvVFQ==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XBIWtgBHlCkS+vZ8du/ROaQ==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XZGQTY55zPUe2fEezbOkU6g==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XMfhihpjkZ0CYpie29lzd5w==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XjZLax0llUEypRuNWQaHFjw==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XOeF7T2G4YkWzbgZPL5cKHg==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XdGJb1L3RJkiohs/eJu4u/Q==}{PluginFilename~Smyde3260.dll~ComponentCLSID~Xg6Sn+QAZsUOCO8NYlrZA/w==}{PluginFilename~Smyde3260.dll~ComponentCLSID~XInuIlmqbFU2fOr/IcxAfqA==}{ComponentName~Shttp://ns.real.com/gemini.v1:rosdeviceconfigdlg~PluginFilename~Smyde3260.dll~ComponentCLSID~XbKr7Vqevd0OV1wvNmnOvMQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:rosaddtoplaylistsdlg~PluginFilename~Smyde3260.dll~ComponentCLSID~XnfhTR5YxTE2z6CVobEOtaA==}{ComponentName~Shttp://ns.real.com/gemini.v1:roscatalogtreecontrol~PluginFilename~Smyde3260.dll~ComponentCLSID~XZOX6UAQy8U+VQB5Jaykg9A==}{ComponentName~Shttp://ns.real.com/gemini.v1:rostoggleablemessage~PluginFilename~Smyde3260.dll~ComponentCLSID~XJE39581ub0uBXWusa1/hVA==}{ComponentName~Shttp://ns.real.com/gemini.v1:rosskipoverwritedlg~PluginFilename~Smyde3260.dll~ComponentCLSID~XuzSa1Ym9HUal+wNGIlvQig==}{ComponentName~Shttp://ns.real.com/gemini.v1:rosprogressoperationdlg~PluginFilename~Smyde3260.dll~ComponentCLSID~XZX09K+aaHk6w1UpcKZKwAw==}{ComponentName~Shttp://ns.real.com/gemini.v1:rosdeviceuiactor~PluginFilename~Smyde3260.dll~ComponentCLSID~Xn81ba+k8GUmkmesNfuskNQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:rosdeletionresultsdlgactor~PluginFilename~Smyde3260.dll~ComponentCLSID~XtlWyeFx6UkevtyrGVEgCyg==}{ComponentName~Shttp://ns.real.com/gemini.v1:roscataloglistview~PluginFilename~Smyde3260.dll~ComponentCLSID~X6wNwJmBuZEeERtslhr9Dow==}{ComponentName~Shttp://ns.real.com/gemini.v1:rositemstosynchronizedlg~PluginFilename~Smyde3260.dll~ComponentCLSID~XEG1UYBvUTE6gUN+zloxMrg==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdburnprefgeneral~IRCAPreferencable~SPrefPage~PluginFilename~Spdbu3210.dll~ComponentCLSID~XCuyTkxy480+hzv3faM6HPw==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdburnprefaudiocd~PluginFilename~Spdbu3210.dll~ComponentCLSID~XLhjKXAyNV0iOmD0+E6l91A==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdburnprefmp3cd~PluginFilename~Spdbu3210.dll~ComponentCLSID~Xk8LVbv0bAEeWxsUbkKPaaA==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdburnprefdatacd~PluginFilename~Spdbu3210.dll~ComponentCLSID~X9A2mSuS/Bk2SnD2pwXfhXw==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XtxTAaCSDNUen4v71BFeSnw==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~Xfka8N5ca1EmJ9AKumyZXhQ==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XXSzgMgI2HkSCfOBCiY2sqA==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~X7LuwuUXZokyndpapdJ8aGg==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XmuQ5qwMIKUW7o/SdkSIWmg==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XfetE0odryEyjRzv5oT3s5Q==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~X17DrBTVvPkucAyjL2atgYw==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XVtgzV+i9vEicVDuLE3q9zA==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XbhD6Wj++mE+vGkL3ZA33OQ==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~X3kiJe6SApEmErvu8zF0Aog==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~X7FeR9rX7+EuPO8xZvBhdlA==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~X62FQM326fUatEElEdsN6pQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:diskspacecheckdlg~PluginFilename~Spdbu3210.dll~ComponentCLSID~XziR0R2w4Z0aHhdcs1OKKZw==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdurlhurlactor~PluginFilename~Spdbu3210.dll~ComponentCLSID~Xp2RhGBbmNk6218FMBmK0Aw==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdburntoggleablecdmodeactor~PluginFilename~Spdbu3210.dll~ComponentCLSID~XZpKkapNMhka8lmo3H4gCKw==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdcdburnhistoryactor~PluginFilename~Spdbu3210.dll~ComponentCLSID~XckGUpvTkokKEAMNabqOUSQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdhelpactor~PluginFilename~Spdbu3210.dll~ComponentCLSID~XPdBLWX9hw0+Q/YoRNoPkIg==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdburninguiactor~PluginFilename~Spdbu3210.dll~ComponentCLSID~X1nPTaSiqRkiIPjQP/Oqv1A==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XgiWKZ8Iy8ECghexAE5KOjQ==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XBQY8U0L6mEOXG3ZCSzCGLQ==}{PluginFilename~Spdbu3210.dll~ComponentCLSID~XoRPMISV65k+cb8iBKBoQBw==}{PluginFilename~Spdctnomad.dll~ComponentCLSID~XJ7Q3QFS9DUGJp0fPRMs5vQ==}{PluginFilename~Spdctnomad.dll~ComponentCLSID~XP3r3FL6u8UqmcERvWeyBxQ==}{PluginFilename~Spdctnomad.dll~ComponentCLSID~Xe0hVgWMeqkW3Sx1gcqegwA==}{PluginFilename~Spdctnomad.dll~ComponentCLSID~XzweIu5DNNk6dnG/SpUP8IQ==}{PluginFilename~Spdctnomad.dll~ComponentCLSID~X6+okYIZSFU6+3I2kuWUMBg==}{PluginFilename~Spdctnomad.dll~ComponentCLSID~XDuADfNorYku5Q5U2VlUdmg==}{ComponentName~Shttp://ns.real.com/gemini.v1:rosdevicecontrollermanager~PluginFilename~Spdge3260.dll~ComponentCLSID~X6sTP/9My1U24GK2hShj5Kg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XQ3zKIRbaNkWBQn1Bu6KAdg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X18w9aAfxEUWbFgrI4X9HOg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XiZzRgmQr+0uK8OZ5bKrG/g==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X3sV6AOGEP02umWafJ7e6bw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XpFXBmTwb2E+lAXajSAY5+g==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XFOQm6nnNU0KN+0JFoVmdXA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XqIay8bis4UepHJkt/oz94Q==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X15AJv1j1AkyQJFooAJCyXA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~Xw0e0rX43mUmGTN/uAfs4Tw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~Xw0e0rX43mUmGTN/uAfs4UA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XNTyWFjKW3UC7SzmsYbebpQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XjFqTnqmH6EqFgqHhFPBfpA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XNfQHe9EjG06pfCiLo+rciQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X3b77CKFf702U7kTIZRkcHw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XhQYabJitWkmHuobmCdFLpQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~Xxz1o1BmLU06ODPfQwm5QVw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XeWtoVH+PkkK6CxbP8MgRqA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XmJmmKBElw0yadMrBZhGe0Q==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XTL/NRyDGR0yH0fwC2pKcWw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XbIz1IzqqrUOYZVvWNpUnjg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XO3MSrJhZMUC/pz+1OzVxOg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XEPPsQ6a7Vk2lDkK5TiLtfw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XxOit5O71f0S7yJ8uX6mITA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XlFclZ7SP/0Wjr/FeNgoVGg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~Xov7afFUdU0WQWBBv1CHsvw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XhEutdBriBkquIIZUbHthlQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X79cs7SHKhU6eG7/xto+chw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XX/RB0yuxU0S5eGfDZ46mfA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X+02CavxE20mslvZH+4QUdQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XVIN3rrB1HE2yDVepduTy/Q==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XrDGKjBbg7k2/Dfa6/RlYwg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XyR2O6ZVpy0GXOtx/7apDiw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X1RwXnaTKGEGSzo1jSr0zZA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XXNexAQ/tpESbtIfrbEW6DA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XrMYgj483yEWfQApVWvO5ig==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XWAN8bxxtlkGiWqhfdZckOg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XEO6d+0mrG0K0dejttWwo8g==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XnThneTCabkWJBalKflD+VQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:pdgenxferconfigmgr~PluginFilename~Spdge3260.dll~ComponentCLSID~XTndHnuHv3U6SJW0zGdJMew==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X0dxkpq8n/EOixWjKxQT5Vw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~Xj0y+Tn4Ym0y4zwwneYqsDw==}{PluginFilename~Spdge32"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\RealNetworks\RealPlayer\6.0\Preferences\PluginHandlerData\PluginInfo1]
@="60.dll~ComponentCLSID~XLp/3qgdD80GoaHd0pniebA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XDQH4RCjfLEeJAePkXmoMIw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XSBEnizj/e0SMai9M0xttvg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X7+uh6tBiLU2MoazixTQDGA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XkyCVjMQjcUCE/lunUP7wAw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XMjR1D1k+VEmuPT75I0Y/Jg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XP+H3V6sA10armDaPhZ4nxQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XPtDm50s87UGMwYaDb+F6Fw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XTLnRn6VvSEut8o6glM21HA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~X1vPFqZgTp0am43ZV3fr/sQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XnnyxE35uGUa/Scoat4uKWw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XYESnXD2eFkmXNfZ7VElvHQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XruZ0EeUqfk+9x9l8LSoGaQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XR3Oq1Y9WYUykd7ZyWdqwPg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XoV+htYhiL0eHroz0KCdYZQ==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XM2npXXRRuU2hFmhgiOEcJA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XIEsnpsj5Uk+Qy5bPnoNIoA==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XgEpGE99GwECoXFlmirkmZg==}{PluginFilename~Spdge3260.dll~ComponentCLSID~Xw1zPyZbws02vFCqdaC4x7Q==}{PluginFilename~Spdge3260.dll~ComponentCLSID~XashVQi4uuUut/E74P4fbfw==}{PluginFilename~Spdge3260.dll~ComponentCLSID~Xx/DkPePZe0KyfCtRZgd37w==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~X49A3zGio6k2D0Bu6HLAf+A==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~XNP/S/296Mk6J2n3OGVZB/g==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~XkK9ud9qZHUy+p+W/gjcdIg==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~XIK1426CluEidsGRuiCY/XQ==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~XoC9nafprrEKZTskW+xgIhA==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~XDGYicXmpTEO1o4SRKybteg==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~X87oLLmsA60mi8vVZYkikJg==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~X8M2PCoABIEyE8kH2I1K8kQ==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~Xwrql2pgFgketMF6JhSDXPw==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~X/OeeNwm53UOS0j9tBasTNw==}{PluginFilename~Spdwmdm.dll~ComponentCLSID~X+d/RJKipg02OGYKEpXxqiQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:medialibraryactor~PluginFilename~Srjbc3260.dll~ComponentCLSID~Xz3Gagbvl7k+fotYFEiGcWQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:rjbmenuactor~PluginFilename~Srjbc3260.dll~ComponentCLSID~X4s1k33gwXkqvSKpayK6Rgw==}{PluginFilename~Srjbc3260.dll~ComponentCLSID~XmBytOtati0OhN++SvsO/cQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:rptemplatemanager~PluginFilename~Srjbc3260.dll~ComponentCLSID~XKqAEBcAtikO4GziM2cnAEQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:RPDownloadMgrActor~PluginFilename~Srjbc3260.dll~ComponentCLSID~XSCYYkQ/ls0yk9xmvxkJ9VA==}{PluginFilename~Srjbc3260.dll~ComponentCLSID~X92zCN4dO1UGQrwMhyd3qRA==}{PluginFilename~Srjbc3260.dll~ComponentCLSID~XRO5h/4NjKUGTIu61HzkU9g==}{ComponentName~Shttp://ns.real.com/gemini.v1:nativemedialibrary~PluginFilename~Srjbc3260.dll~ComponentCLSID~XtBE+ZotXfkm45FUdI0QpVA==}{ComponentName~Shttp://ns.real.com/gemini.v1:nativemedialibrarytree~PluginFilename~Srjbc3260.dll~ComponentCLSID~Xf+5baHFowEe9ElT/gk+x7w==}{ComponentName~Shttp://ns.real.com/gemini.v1:nativeautoplaylistmanager~PluginFilename~Srjbc3260.dll~ComponentCLSID~Xf+5baHJowEe9ElT/gk+x7w==}{ComponentName~Shttp://ns.real.com/gemini.v1:licenseacquisitionhelper~PluginFilename~Srjbc3260.dll~ComponentCLSID~XwTV49pYP1hGt0gDA8ECmGg==}{ComponentName~Shttp://ns.real.com/gemini.v1:rpdatabase~PluginFilename~Srjbc3260.dll~ComponentCLSID~XdGxGPLn8gUahHGwv2StEyQ==}{PluginFilename~Srjbc3260.dll~ComponentCLSID~XnrIlF+oHxE2GqRsLFACNiA==}{PluginFilename~Srjbc3260.dll~ComponentCLSID~Xmbrbbw96aUqWw22s4eMi5Q==}{PluginFilename~Srjbc3260.dll~ComponentCLSID~XMERKAJhTbkaaKxDSioA8Aw==}{PluginFilename~Srjbc3260.dll~ComponentCLSID~XSJ5j1v59l0unfPVzm0+yfg==}{ComponentName~Shttp://ns.real.com/gemini.v1:nativerjbapplication~PluginFilename~Srjbdll.dll~ComponentCLSID~X1W+pGzTmAU6qA9lfbdTQWA==}{ComponentName~Shttp://ns.real.com/gemini.v1:rjbactor~PluginFilename~Srjbdll.dll~ComponentCLSID~Xva4TuczCm0GHOIaNnXi4mg==}{ComponentName~Shttp://ns.real.com/gemini.v1:RPAddClipsActor~PluginFilename~Srjbdll.dll~ComponentCLSID~Xh6yt0pLMBEeNcQyEn+595g==}{PluginFilename~Srjbdll.dll~ComponentCLSID~XestUe5fH4EKYbS7/PbC/dg==}{ComponentName~Shttp://ns.real.com/gemini.v1:devicedroptarget~PluginFilename~Srjbdll.dll~ComponentCLSID~XrOZOqC0HSkazTMiiHGHbRQ==}{PluginFilename~Srjbdll.dll~ComponentCLSID~XHYlERg0I4UarpgXQ9KcTPg==}{PluginFilename~Srjbdll.dll~ComponentCLSID~XPmjzWBzeCUer0rmiE0qMHw==}{PluginFilename~Srjbdll.dll~ComponentCLSID~XayFacM2HdE21Dt8n1hM61A==}{PluginFilename~Srjbdll.dll~ComponentCLSID~XzELQyOv7l0C8bWNWyL9hrg==}{ComponentName~Shttp://ns.real.com/gemini.v1:rpeqactor~PluginFilename~Srjbe3260.dll~ComponentCLSID~X1LH2uuTm1BGTRwDQt7I98A==}{PluginFilename~Srjbs3260.dll~ComponentCLSID~X2AZolTjB00ytpr/YMHENmQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:rjbcustomcontrolactor~PluginFilename~Srjbs3260.dll~ComponentCLSID~XbFubnZGJxEGel1+t5QcSDA==}{ComponentName~Shttp://ns.real.com/gemini.v1:crossfadeactor~PluginFilename~Srjbxfade.dll~ComponentCLSID~X+DZJ7f83CEaMzEEi0i4E8A==}{IRCAPreferencable~SPrefPage~PluginFilename~Srjmisc.dll~ComponentCLSID~Xs3RTL5fZYUWCRRX5ihvOEA==}{IRCAPreferencable~SPrefPage~PluginFilename~Srjmisc.dll~ComponentCLSID~XZp0X+N6wEEiYRRq4BcuRww==}{IRCAPreferencable~SPrefPage~PluginFilename~Srjmisc.dll~ComponentCLSID~XSPeZpO9Jh0eIgzvtc0Z2sg==}{IRCAPreferencable~SPrefPage~PluginFilename~Srjmisc.dll~ComponentCLSID~X+Fgg5xVVBUOz3jviwehu2Q==}{IRCAPreferencable~SPrefPage~PluginFilename~Srjmisc.dll~ComponentCLSID~XysvYYzK0akGmwJ72SlKWKA==}{IRCAPreferencable~SPrefPage~PluginFilename~Srjmisc.dll~ComponentCLSID~XI7gO9txx8UKqGyUF1Hsaxw==}{PluginFilename~Srpap3260.dll~ComponentCLSID~XiRT3Bv9DbEKU6Ux1TCelAQ==}{ComponentName~Shttp://ns.real.com/viper.v1:RPFrameWindowActor~PluginFilename~Srpap3260.dll~ComponentCLSID~XI0GawtyqakyQYvXfi2nZPQ==}{ComponentName~Shttp://ns.real.com/viper.v1:_rpskinmanager~PluginFilename~Srpap3260.dll~ComponentCLSID~XkdstWlNN5USqADNkz9vSdg==}{ComponentName~Shttp://ns.real.com/viper.v1:http://ns.real.com/viper.v1~PluginFilename~Srpap3260.dll~ComponentCLSID~XZfbp11r1SkCr9Ea1l+TUZQ==}{PluginFilename~Srpap3260.dll~ComponentCLSID~XIzecvUPgJEOoGqR7csQn1w==}{PluginFilename~Srpap3260.dll~ComponentCLSID~XqFzhbIWh9Uid7fqzMhBqHw==}{PluginFilename~Srpap3260.dll~ComponentCLSID~XW/fye8K2K02EFNJ085fEkA==}{PluginFilename~Srpap3260.dll~ComponentCLSID~XswfKoCgdbUONJGSl+phlcA==}{PluginFilename~Srpap3260.dll~ComponentCLSID~XtrTzYPxdw0yef1NP/XrD+g==}{PluginFilename~Srpap3260.dll~ComponentCLSID~XSPWYqsyRWEGoSs+/mt4Dzg==}{PluginFilename~Srpap3260.dll~ComponentCLSID~XcYYA5t2snkS9O1tYFLAMWA==}{PluginFilename~Srpap3260.dll~ComponentCLSID~X9jYD3CW+RkKxtXXtw5BtRw==}{PluginFilename~Srpappdemon.dll~ComponentCLSID~Xk3FTTq3it0SiNCfo8ZIVxA==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XgOZpQdC+SEWsq9SN/Op5RQ==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XFDdHvbNxHkqT4BuHjkzt+A==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XczBEpUJvU02oAvL4iVlNcw==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XgqT4AiKWCk+PybAXCGifDg==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XL2RxoqZeCUeHgGP36kqTTw==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XYK0zn7y88E22vsF6Byr6nA==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~X8FzB82X+0hGn5gDA8DGKWQ==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XXA2J8mqqhkWpwJW26g33yw==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XTIwar04ck0qIPBYr5jNMEQ==}{ComponentName~Shttp://ns.real.com/gemini.v1:_rpsystemsettingsdb~PluginFilename~Srpcl3260.dll~ComponentCLSID~XFOBygqvLQU6ZywcWJeycTA==}{ComponentName~Shttp://ns.real.com/gemini.v1:_rpregistrydb~PluginFilename~Srpcl3260.dll~ComponentCLSID~XGrzsEgIhi06aucWRl86Pww==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~X/WH7sw5ow0+A/xDfxgcPyA==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XBpDcEXSyPkiVJc4PM7umig==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XBRQiAUmJZU2lHB48kePS/Q==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XIjUyT2m3ekex63CnHUdTqw==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XZhwZyHMNf067q2b4nIJnOw==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~X5SpD4VMbpkGeXpxiTEl/Mg==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~X7KRU02R7Nk2cDmFSFg44vw==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XDKRe4zjTzECcT2YRTzLr4A==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XAcANo9F01RGttgDA8ECmGg==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XNeJ5c+I/mUCVwo6BPHFqww==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~X9T6V8ARhG0C7EC99zfzJag==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XFAO0kbReVE+bDCa1RKL1mQ==}{PluginFilename~Srpcl3260.dll~ComponentCLSID~XrO9TAK+y9E24XPD+e65wMQ==}{PluginFilename~Srpcomproxy.dll~ComponentCLSID~X2qIcFVxQXEezOjUN9G5p/A==}{PluginFilename~Srpcomproxy.dll~ComponentCLSID~X4g05z8xrek2FBGMVX0aiYw==}{PluginFilename~Srpcomproxy.dll~ComponentCLSID~XoNIJGJFgnUa9hUKrg2JaWw==}{PluginFilename~Srpcomproxy.dll~ComponentCLSID~XhWryN5xzl0KOBMaslKhI1A==}{PluginFilename~Srpds3260.dll~rpplayersupportedextensions~Savi|vob|dat|divx|mid|midi|mpg|mpeg~rpplayersupportedmimetypes~Svideo/msvideo~rpplayersupportedprotocols~Sfile~rpplayersupportedtracktypes~SDVD|VCD~ComponentCLSID~X+MtPZlfg+k+1+EPeGsyQrQ==}{PluginFilename~Srpds3260.dll~ComponentCLSID~X7an57I/tbkq86wihSA4CIA==}{PluginFilename~Srpds3260.dll~ComponentCLSID~XxgJgPrysRkaz9z5brFDy6g==}{PluginFilename~Srpds3260.dll~ComponentCLSID~XT3lC6KX0uk6vnHXjcOrxOg==}{ComponentName~Shttp://ns.real.com/gemini.v1:rpdvdactor~PluginFilename~Srpds3260.dll~ComponentCLSID~X2sCeKMuB4E6yWCvPF/NFAw==}{ComponentName~Shttp://ns.real.com/gemini.v1:firstrunactor~PluginFilename~Srpgu3260.dll~ComponentCLSID~XIHcOIocn/0OuiwdiMmz1WA==}{ComponentName~Shttp://ns.real.com/gemini.v1:rpbubbleactor~PluginFilename~Srpgu3260.dll~ComponentCLSID~XO73hIAmGfkepRD+iSWvGOw==}{PluginFilename~Srpgu3260.dll~ComponentCLSID~XtanxWFEX6UaOn0X+JEA4QA==}{ComponentName"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ED5AD83E-C897-4566-A286-214CE9D24FC3}\1.0]

Cheers for your continued help. Stephen
@="OTX Preloader 1.0 Type Library"

[didom]

This log looks clean!

• Don't forget to re-hide all files and folders. To re-hide all files and folders:
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading deselect "Show hidden files and folders".
  • Check the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
• This is a good time to set up protection against further attacks. Read the article behind this link "How did I get infected". If you don't already have them, you need an antivirus that is updated, a good firewall for example Kerio Personal Firewall or ZoneLabs Zone Alarm, a spyware blocker like SpywareBlaster and also IE-Spyads and spyware detection (Ad-aware SE and SpyBot S+D). All of these have good free versions available... be very cautious about any security software that advertises in popups or other intrusive ways, they are not only usually useless, but also often have malware in them....
  
  Instead of Internet Explorer, use a different browser like Opera, Mozilla or Firefox.
  
  Last, but not least, you need to keep Windows and Internet Explorer up to date by getting all the latest security patches that protects your computer.
  
  This can be accessed by going to http://windowsupdate.microsoft.com and following the prompts.
  
  Please post back if you are still having any problems....