Here is the Spy Sweeper session log:
5:59 PM: |··· Start of Session, Sunday, October 02, 2005 ···|
5:59 PM: Spy Sweeper started
5:59 PM: Sweep initiated using definitions version 547
5:59 PM: Starting Memory Sweep
6:01 PM: Memory Sweep Complete, Elapsed Time: 00:01:48
6:01 PM: Starting Registry Sweep
6:01 PM: Found Adware: cws-aboutblank
6:01 PM: HKCR\protocols\filter\text/html\ (2 subtraces) (ID = 114343)
6:01 PM: HKLM\software\classes\protocols\filter\text/html\ (2 subtraces) (ID = 115907)
6:01 PM: Found Adware: ist software
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\ist\ (3 subtraces) (ID = 129108)
6:01 PM: Found Adware: linkmaker
6:01 PM: HKLM\software\classes\typelib\{423550e9-2f83-4678-9929-c1774088b180}\ (9 subtraces) (ID = 129743)
6:01 PM: HKCR\typelib\{423550e9-2f83-4678-9929-c1774088b180}\ (9 subtraces) (ID = 129750)
6:01 PM: Found Adware: maxifiles
6:01 PM: HKCR\shorty.gopher\ (5 subtraces) (ID = 134839)
6:01 PM: HKCR\shorty.gopher.1\ (3 subtraces) (ID = 134840)
6:01 PM: HKLM\software\classes\shorty.gopher\ (5 subtraces) (ID = 134843)
6:01 PM: HKLM\software\classes\shorty.gopher.1\clsid\ (1 subtraces) (ID = 134844)
6:01 PM: HKLM\software\classes\shorty.gopher.1\ (3 subtraces) (ID = 134845)
6:01 PM: Found Adware: powerscan
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\powerscan\ (1 subtraces) (ID = 136823)
6:01 PM: HKLM\software\microsoft\windows\currentversion\run\ || power scan (ID = 136825)
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\power scan\ (2 subtraces) (ID = 136826)
6:01 PM: Found Trojan Horse: rbot
6:01 PM: HKLM\software\krypton\ (6 subtraces) (ID = 139241)
6:01 PM: Found Adware: media-motor
6:01 PM: HKCR\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\ (27 subtraces) (ID = 140032)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\inprocserver32\ (2 subtraces) (ID = 140081)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\miscstatus\ (3 subtraces) (ID = 140082)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\progid\ (1 subtraces) (ID = 140083)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\toolboxbitmap32\ (1 subtraces) (ID = 140084)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\typelib\ (1 subtraces) (ID = 140085)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\version\ (1 subtraces) (ID = 140086)
6:01 PM: HKLM\software\classes\typelib\{466c63ac-f26e-49f1-861a-e07da768a46a}\ (9 subtraces) (ID = 140131)
6:01 PM: HKLM\software\mm\ (1 subtraces) (ID = 140211)
6:01 PM: HKCR\typelib\{466c63ac-f26e-49f1-861a-e07da768a46a}\ (9 subtraces) (ID = 140223)
6:01 PM: Found Adware: search fast communicator toolbar
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\communicator toolbar\ (10 subtraces) (ID = 140688)
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\microsoft\internet explorer\toolbar\webbrowser\ || {4e7bd74f-2b8d-469e-8dbc-a42eb79cb428} (ID = 140689)
6:01 PM: Found Adware: shopathomeselect
6:01 PM: HKLM\software\ || test (ID = 141678)
6:01 PM: Found Trojan Horse: trojan downloader matcash
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\microsoft\windows\currentversion\run\ || dns (ID = 144713)
6:01 PM: Found Adware: winad
6:01 PM: HKCR\mediapassx.installer\ (3 subtraces) (ID = 147160)
6:01 PM: HKLM\software\classes\mediapassx.installer\ (3 subtraces) (ID = 147174)
6:01 PM: HKLM\software\media pass\ (4 subtraces) (ID = 147183)
6:01 PM: Found Adware: ist yoursitebar
6:01 PM: HKCR\clsid\{86227d9c-0efe-4f8a-aa55-30386a3f5686}\ (14 subtraces) (ID = 147831)
6:01 PM: HKCR\interface\{03b800f9-2536-4441-8cda-2a3e6d15b4f8}\ (8 subtraces) (ID = 147832)
6:01 PM: HKCR\interface\{dfbcc1eb-b149-487e-80c1-cc1562021542}\ (8 subtraces) (ID = 147835)
6:01 PM: HKLM\software\classes\clsid\{86227d9c-0efe-4f8a-aa55-30386a3f5686}\ (14 subtraces) (ID = 147837)
6:01 PM: HKLM\software\classes\interface\{03b800f9-2536-4441-8cda-2a3e6d15b4f8}\ (8 subtraces) (ID = 147838)
6:01 PM: HKLM\software\classes\interface\{dfbcc1eb-b149-487e-80c1-cc1562021542}\ (8 subtraces) (ID = 147841)
6:01 PM: HKLM\software\classes\typelib\{4ee12b71-aa5e-45ec-8666-2db3ad3fdf44}\ (9 subtraces) (ID = 147842)
6:01 PM: HKLM\software\classes\ysb.ysbobj.1\ (3 subtraces) (ID = 147846)
6:01 PM: HKLM\software\classes\ysb.ysbobj\ (5 subtraces) (ID = 147847)
6:01 PM: HKLM\software\microsoft\internet explorer\toolbar\ || {86227d9c-0efe-4f8a-aa55-30386a3f5686} (ID = 147852)
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\microsoft\internet explorer\toolbar\webbrowser\ || {86227d9c-0efe-4f8a-aa55-30386a3f5686} (ID = 147853)
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\yoursitebar\ (5 subtraces) (ID = 147859)
6:01 PM: HKLM\software\yoursitebar\ (21 subtraces) (ID = 147860)
6:01 PM: HKCR\typelib\{4ee12b71-aa5e-45ec-8666-2db3ad3fdf44}\ (9 subtraces) (ID = 147861)
6:01 PM: HKCR\ysb.ysbobj.1\ (3 subtraces) (ID = 147865)
6:01 PM: HKCR\ysb.ysbobj\ (5 subtraces) (ID = 147866)
6:01 PM: Found Adware: surf accuracy
6:01 PM: HKLM\software\sacc\ (2 subtraces) (ID = 203068)
6:01 PM: HKLM\software\microsoft\windows\currentversion\run\ || surfaccuracy (ID = 203069)
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\sacc\ (2 subtraces) (ID = 203070)
6:01 PM: Found Adware: quicklink search toolbar
6:01 PM: HKCR\clsid\{8b6da27e-7f64-4694-8f8f-dc87ab8c6b22}\ (8 subtraces) (ID = 359437)
6:01 PM: HKLM\software\classes\clsid\{8b6da27e-7f64-4694-8f8f-dc87ab8c6b22}\ (8 subtraces) (ID = 359440)
6:01 PM: HKCR\quicklinks.linktracker.1\ (3 subtraces) (ID = 359448)
6:01 PM: HKCR\quicklinks.linktracker\ (3 subtraces) (ID = 359449)
6:01 PM: HKCR\quicklinks.quicklinksfilter.1\ (3 subtraces) (ID = 359450)
6:01 PM: HKCR\quicklinks.quicklinksfilter\ (3 subtraces) (ID = 359451)
6:01 PM: HKLM\software\classes\quicklinks.linktracker.1\ (3 subtraces) (ID = 359452)
6:01 PM: HKLM\software\classes\quicklinks.linktracker\ (3 subtraces) (ID = 359453)
6:01 PM: HKLM\software\classes\quicklinks.quicklinksfilter.1\ (3 subtraces) (ID = 359454)
6:01 PM: HKLM\software\classes\quicklinks.quicklinksfilter\ (3 subtraces) (ID = 359455)
6:01 PM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{8b6da27e-7f64-4694-8f8f-dc87ab8c6b22}\ (ID = 359456)
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\quick links\ (2 subtraces) (ID = 359457)
6:01 PM: HKLM\software\ql\ (4 subtraces) (ID = 359458)
6:01 PM: Found Adware: cydoor
6:01 PM: HKU\WRSS_Profile_S-1-5-21-448539723-1078145449-1060284298-1002\software\cydoor\ (602 subtraces) (ID = 639126)
6:01 PM: HKU\WRSS_Profile_S-1-5-21-448539723-1078145449-1060284298-1002\software\cydoor services\ (12 subtraces) (ID = 639128)
6:01 PM: HKCR\clsid\{3551784b-e99a-474f-b782-3ec814442918}\ (10 subtraces) (ID = 727328)
6:01 PM: HKLM\software\classes\clsid\{3551784b-e99a-474f-b782-3ec814442918}\ (10 subtraces) (ID = 727357)
6:01 PM: Found Adware: abetterinternet
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\bsto-1\ (7 subtraces) (ID = 746835)
6:01 PM: HKCR\iecatcher.iewebcatcher\ (5 subtraces) (ID = 829231)
6:01 PM: HKCR\iecatcher.iewebcatcher.1\ (3 subtraces) (ID = 829237)
6:01 PM: HKCR\typelib\{fff24f28-3ae2-46cd-aebe-2f625133a1ca}\ (9 subtraces) (ID = 829253)
6:01 PM: HKLM\software\classes\typelib\{fff24f28-3ae2-46cd-aebe-2f625133a1ca}\ (9 subtraces) (ID = 829282)
6:01 PM: HKLM\software\classes\iecatcher.iewebcatcher\ (5 subtraces) (ID = 829292)
6:01 PM: HKLM\software\classes\iecatcher.iewebcatcher.1\ (3 subtraces) (ID = 829298)
6:01 PM: Registry Sweep Complete, Elapsed Time:00:00:09
6:01 PM: Starting Cookie Sweep
6:01 PM: Found Spy Cookie: yieldmanager cookie
6:01 PM:
[email protected][1].txt (ID = 3751)
6:01 PM: Found Spy Cookie: addynamix cookie
6:01 PM:
[email protected][1].txt (ID = 2062)
6:01 PM: Found Spy Cookie: advertising cookie
6:01 PM: herb@advertising[1].txt (ID = 2175)
6:01 PM: Found Spy Cookie: centrport net cookie
6:01 PM: herb@centrport[1].txt (ID = 2374)
6:01 PM: Found Spy Cookie: servedby advertising cookie
6:01 PM:
[email protected][1].txt (ID = 3335)
6:01 PM: Found Spy Cookie: trafficmp cookie
6:01 PM: herb@trafficmp[2].txt (ID = 3581)
6:01 PM: Found Spy Cookie: adserver cookie
6:01 PM:
[email protected][1].txt (ID = 2142)
6:01 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01
6:01 PM: Starting File Sweep
6:01 PM: c:\program files\power scan (ID = -2147480461)
6:01 PM: Found Adware: hungryhands
6:01 PM: c:\winnt\winskw (5 subtraces) (ID = -2147480862)
6:01 PM: c:\program files\quick links (2 subtraces) (ID = -2147478145)
6:02 PM: bkqkmq.exe (ID = 151212)
6:02 PM: mc-58-12-0000140.exe.tcf (ID = 114256)
6:02 PM: m67m.inf (ID = 144896)
6:02 PM: Warning: Failed to read file "c:\winnt\downloaded program files\mm81.ocx". System Error. Code: 5.
Access is denied
6:03 PM: preuninstallql.exe (ID = 131326)
6:03 PM: m67m.inf (ID = 144896)
6:03 PM: m67m.inf (ID = 144896)
6:03 PM: jau5055.dat (ID = 62535)
6:03 PM: mc-58-12-0000137.exe (ID = 114256)
6:03 PM: saccu.exe (ID = 156655)
6:03 PM: Found Adware: flashtrack
6:03 PM: ftkclean.exe (ID = 112746)
6:04 PM: Warning: Failed to read file "c:\winnt\downloaded program files\conflict.2\mm81.ocx". System Error. Code: 5.
Access is denied
6:04 PM: ftkcpy_inst.exe.tcf (ID = 112748)
6:04 PM: Found Adware: igetnet
6:04 PM: install_all.dll (ID = 63457)
6:05 PM: unstall.exe (ID = 133210)
6:05 PM: qlink32.dll (ID = 153756)
6:06 PM: Found Adware: ignkeys
6:06 PM: rsp001.dll (ID = 63475)
6:17 PM: mc-58-12-0000140.exe.tcf (ID = 156269)
6:17 PM: update_com.dll (ID = 63476)
6:17 PM: mc-58-12-0000140.exe3510.tcf (ID = 156269)
6:17 PM: Warning: Failed to read file "c:\recycler\
6:17 PM: mc-58-12-0000140.exe (ID = 156275)
6:17 PM: backup-20050930-121732-540.dll (ID = 156267)
6:17 PM: Warning: Failed to read file "c:\winnt\downloaded program files\conflict.1\mm81.ocx". System Error. Code: 5.
Access is denied
6:17 PM: backup-20050930-121732-141.dll (ID = 156267)
6:17 PM: mc-58-12-0000137.exe (ID = 156275)
6:17 PM: uninst.exe (ID = 73428)
6:17 PM: alchem.inf (ID = 83109)
6:17 PM: rules.dat (ID = 63478)
6:17 PM: power scan.lnk (ID = 72676)
6:17 PM: Found Adware: comet cursor
6:17 PM: cc.inf (ID = 53467)
6:17 PM: Found Adware: twain-tech
6:17 PM: wininit.ini (ID = 81900)
6:17 PM: ydn5055.dat (ID = 62547)
6:17 PM: File Sweep Complete, Elapsed Time: 00:15:48
6:17 PM: Full Sweep has completed. Elapsed time 00:17:50
6:17 PM: Traces Found: 1091
6:20 PM: Removal process initiated
6:20 PM: Quarantining All Traces: cws-aboutblank
6:20 PM: Quarantining All Traces: ist software
6:20 PM: Quarantining All Traces: linkmaker
6:20 PM: Quarantining All Traces: maxifiles
6:20 PM: Quarantining All Traces: powerscan
6:20 PM: Quarantining All Traces: rbot
6:20 PM: Quarantining All Traces: media-motor
6:20 PM: Quarantining All Traces: search fast communicator toolbar
6:20 PM: Quarantining All Traces: shopathomeselect
6:20 PM: Quarantining All Traces: trojan downloader matcash
6:20 PM: Quarantining All Traces: winad
6:20 PM: Quarantining All Traces: ist yoursitebar
6:20 PM: Quarantining All Traces: surf accuracy
6:20 PM: Quarantining All Traces: quicklink search toolbar
6:20 PM: Quarantining All Traces: cydoor
6:20 PM: Quarantining All Traces: abetterinternet
6:20 PM: Quarantining All Traces: yieldmanager cookie
6:20 PM: Quarantining All Traces: addynamix cookie
6:20 PM: Quarantining All Traces: advertising cookie
6:20 PM: Quarantining All Traces: centrport net cookie
6:20 PM: Quarantining All Traces: servedby advertising cookie
6:20 PM: Quarantining All Traces: trafficmp cookie
6:20 PM: Quarantining All Traces: adserver cookie
6:20 PM: Quarantining All Traces: hungryhands
6:20 PM: Quarantining All Traces: flashtrack
6:20 PM: Quarantining All Traces: igetnet
6:20 PM: Quarantining All Traces: ignkeys
6:20 PM: Quarantining All Traces: comet cursor
6:20 PM: Quarantining All Traces: twain-tech
6:21 PM: Removal process completed. Elapsed time 00:01:29
********
5:58 PM: |··· Start of Session, Sunday, October 02, 2005 ···|
5:58 PM: Spy Sweeper started
5:58 PM: Sweep initiated using definitions version 547
5:58 PM: Starting Memory Sweep
5:58 PM: Sweep Canceled
5:58 PM: Memory Sweep Complete, Elapsed Time: 00:00:06
5:58 PM: Traces Found: 0
5:59 PM: |··· End of Session, Sunday, October 02, 2005 ···|
********
5:56 PM: |··· Start of Session, Sunday, October 02, 2005 ···|
5:56 PM: Spy Sweeper started
5:56 PM: Messenger service has been disabled.
5:58 PM: |··· End of Session, Sunday, October 02, 2005 ···|
And here is another Hijack This log:
Logfile of HijackThis v1.99.1
Scan saved at 6:24:35 PM, on 10/2/2005
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\FSI\F-Prot\fpavupdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\UAService7.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\msiexec.exe
C:\Program Files\FSI\F-Prot\F-Sched.exe
C:\Program Files\FSI\F-Prot\F-StopW.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O1 - Hosts: 217.116.231.7 aimtoday.aol.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [hpfsched] C:\WINNT\hpfsched.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: YExplorer1_8US.CAB -
http://photos.groups...plorer1_8us.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai...all/xscan53.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoft...free/asinst.cabO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINNT\system32\UAService7.exe