Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Lockx, Pokapoka, other junk and my Hijackthis log [Resolved] [RESOLVED

Started by grizzlyoflight , Oct 10 2005 07:43 PM

  • This topic is locked This topic is locked

#1
grizzlyoflight
Posted 10 October 2005 - 07:43 PM

grizzlyoflight

    Member

  • Member
  • PipPip
  • 18 posts
those are two viruses I know of right now. I also, have a two folders for programs that were not downloaded by me. IGet and 180SearchToolbar...can not delete either.

Logfile of HijackThis v1.99.1
Scan saved at 6:47:08 PM, on 10/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\etb\pokapoka75.exe
C:\Program Files\Common Files\Windows\services32.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Common Files\services.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Common Files\services.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Steve\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.sitesearc...ral.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sitesearc...ral.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sitesearc...ral.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\DOCUME~1\Steve\LOCALS~1\Temp\\xx.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\InetGet\Adperform180safull.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [System service75] C:\WINDOWS\etb\pokapoka75.exe
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {82F2D6B2-6C58-4404-A930-9DB0FD90D4B1} (Driver_Detective_v43_Non_Member.DD_v43) - http://www.drivershq..._Non_Member.CAB
O18 - Protocol: bw+0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


Just ran AIMFix. Things are quarentined but still have the 180search thing...can I delete the quarentined?

Edited by grizzlyoflight, 16 October 2005 - 09:16 PM.

  • 0

Advertisements

#2
greyknight17
Posted 10 October 2005 - 08:07 PM

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Welcome to GTG.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Please download Ewido Security Suite at http://www.ewido.net/en/download/.

1. Install Ewido Security Suite.
2. When installing, under 'Additional Options' uncheck:
* Install background guard
* Install scan via context menu
3. Launch Ewido, there should be an icon on your desktop, double click it.
4. The program will now open to the main screen.
5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment.
6. You will need to update Ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on Start Update.
7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'.
8. Exit Ewido. DO NOT scan yet.

If you are having problems with the updater, you can go to http://www.ewido.net...wnload/updates/ to update manually.

Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. Don't run it yet.

Download CWShredder at http://www.greyknigh.../CWShredder.exe and run it. Click on 'I Agree' button if you agree. Click on 'Fix' (it will automatically fix anything it finds for you) and then click OK. If it asks if you want to delete a certain random file, choose No and post that filename here. Let it finish the scan and then hit Next and Exit.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff.

Now open Ewido and do a scan on your system.

* Click on scanner
* Click on Complete System Scan and the scan will begin.
* NOTE: During some scans with Ewido it is finding cases of false positives.
o You will need to step through the process of cleaning files one-by-one.
o If Ewido detects a file you KNOW to be legitimate, select none as the action.
o Do NOT select 'Perform action on all infections'
o If you are unsure of any entry found, select none for now as the action.
* Once the scan has completed, there will be a button located on the bottom of the screen named Save report
* Click Save report.
* Save the report .txt file to your desktop or a location where you can find it easily.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.sitesearc...ral.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sitesearc...ral.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sitesearc...ral.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\DOCUME~1\Steve\LOCALS~1\Temp\\xx.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\InetGet\Adperform180safull.exe
O4 - HKLM\..\Run: [System service75] C:\WINDOWS\etb\pokapoka75.exe

Check and fix ALL the O18 entries related to Logitech, except for the first line (see below). Leave that unchecked:

O18 - Protocol: bw+0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

Locate and delete the following:

C:\Program Files\Common Files\Windows\services32.exe
C:\Program Files\Common Files\services.exe
C:\Program Files\InetGet\
C:\Program Files\InetGet2\

Restart your computer. Post the logs for HijackThis and Ewido.
  • 0

#3
grizzlyoflight
Posted 10 October 2005 - 11:37 PM

grizzlyoflight

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
The two logs as requested:

Logfile of HijackThis v1.99.1
Scan saved at 10:22:15 PM, on 10/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Steve\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {82F2D6B2-6C58-4404-A930-9DB0FD90D4B1} (Driver_Detective_v43_Non_Member.DD_v43) - http://www.drivershq..._Non_Member.CAB
O18 - Protocol: bw+0 - {AA22D121-52A1-412B-957B-2AC81BBC3694} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

And the other...

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:17:30 PM, 10/10/2005
+ Report-Checksum: D5FD267E

+ Scan result:

HKU\S-1-5-21-220523388-1202660629-839522115-1003\Software\DNS -> Adware.Shorty : Cleaned with backup
HKU\S-1-5-21-220523388-1202660629-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{79849612-A98F-45B8-95E9-4D13C7B6B35C} -> Spyware.Crazywinnings : Cleaned with backup
HKU\S-1-5-21-220523388-1202660629-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E0CE16CB-741C-4B24-8D04-A817856E07F4} -> Spyware.Roimoi : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.80:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.81:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.119:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.120:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.121:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.123:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.156:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.165:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.166:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.167:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.168:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.172:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.183:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.203:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.204:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.205:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.206:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.215:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.216:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.217:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.220:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.221:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.222:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.223:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.224:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.225:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.226:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.227:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.237:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.238:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.240:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.252:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.253:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.254:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.308:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.309:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.310:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.311:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.312:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.313:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.330:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.331:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.332:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.333:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.334:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.340:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.341:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.356:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.364:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.366:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.382:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.384:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.385:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.386:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.393:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.410:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.433:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.434:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.438:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.440:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.441:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.442:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.443:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.444:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.445:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.467:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
:mozilla.472:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.474:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.475:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.476:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.477:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.478:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.479:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.482:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.483:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.484:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.490:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.491:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.492:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Masterstats : Cleaned with backup
:mozilla.493:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.494:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.503:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.505:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.506:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.518:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.520:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.527:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.528:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.529:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.557:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.558:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.559:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.563:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.564:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.565:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.568:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Sexlist : Cleaned with backup
:mozilla.570:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.572:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.573:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.583:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.595:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.596:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.597:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.598:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.599:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.600:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.601:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.602:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.603:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.607:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.614:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.615:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.616:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.617:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.618:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.619:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.620:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.621:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.622:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.624:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.625:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.626:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.627:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.628:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.629:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.630:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.641:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.645:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.651:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.658:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.659:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.672:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.684:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.685:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.686:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.688:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.716:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.717:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.718:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.719:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.720:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.721:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.722:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.723:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.742:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.756:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.757:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.758:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.759:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.771:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.772:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.782:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.783:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.784:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.794:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.800:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.801:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.802:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.805:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.809:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.810:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.811:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.823:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.824:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.825:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.831:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.834:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.849:C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\default.igw\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Linkbuddies : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Steve\Application Data\Phoenix\Profiles\default\456kpn30.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Steve\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-1e8c157d-307edf30.class -> Trojan.Byteverify : Cleaned with backup
C:\Program Files\Common Files\system32.dll/gui.exe -> TrojanDownloader.Agent.rv : Error during cleaning
C:\Program Files\DNS\gui.exe -> TrojanDownloader.Agent.rv : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.48:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.49:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.50:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.51:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.94:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.95:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.96:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.97:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.98:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.101:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.102:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.103:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.104:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.105:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.106:C:\RECYCLER\NPROTECT\00000008.MOZ -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.107:C:\RECY
  • 0

#4
grizzlyoflight
Posted 10 October 2005 - 11:41 PM

grizzlyoflight

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
seems to have been cut off. I'll try to attach it.

Oh, and I found a few related files including what I believe was the original one and deleted those...yet I couldn't find the services32.exe file.

Attached Files


Edited by grizzlyoflight, 10 October 2005 - 11:46 PM.

  • 0

#5
greyknight17
Posted 11 October 2005 - 07:14 PM

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Download KillBox http://www.greyknigh...spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Copy the below files and go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say Yes:

C:\Program Files\Common Files\system32.dll

If you get a PendingOperations message, just close it and restart your computer manually.

Your log is clean.

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.
  • 0

#6
grizzlyoflight
Posted 11 October 2005 - 07:18 PM

grizzlyoflight

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
Says fine does not exist when that was tried.

There are 2 other problems now but give me a sec to write down the warning messages.
  • 0

#7
grizzlyoflight
Posted 11 October 2005 - 07:25 PM

grizzlyoflight

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
DBNDLL.exe will no run...due to windows shutting down.

That's new and so is a sound degradation as from a another warning (that I can not force). the dll that is named starts with MS
  • 0

#8
grizzlyoflight
Posted 12 October 2005 - 07:45 AM

grizzlyoflight

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
here are the two new Warnings:

DBNDLL32.exe
The instruction "0x7c910e03" referenced memory at "0x87650f00" the memory could not be written

MSEDISPL.exe
The Instruction at "0x0032067f" referenced memory at "0x0000003c". Memory could not be read.
  • 0

#9
greyknight17
Posted 12 October 2005 - 09:07 PM

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
See if you can find and delete these two files:

MSEDISPL.exe
DBNDLL32.exe

Right click on this link http://www.greyknigh...spy/RegSrch.vbs and choose 'Save As'. Save it somewhere. Now run that program and do a search for these files (if more than one, make sure to search and save them separately):

MSEDISPL.exe
DBNDLL32.exe

Save the file/files and post the results in the forum.
  • 0

#10
iluvwaffle3
Posted 12 October 2005 - 09:15 PM

iluvwaffle3

    New Member

  • Member
  • Pip
  • 1 posts
I have lockx.exe on my computer. I think I deleted it and I did a virus scan, but every time I restart my computer a message pops up asking me if I want to run the program lockx.exe. Any suggestions how I can remove this softwear for good?
  • 0

Advertisements

#11
grizzlyoflight
Posted 12 October 2005 - 09:32 PM

grizzlyoflight

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
Start a new thread with a hijackthis report for your computer...they are very helpful here

Edited by grizzlyoflight, 12 October 2005 - 09:32 PM.

  • 0

#12
greyknight17
Posted 12 October 2005 - 10:18 PM

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
:tazz: Yes, what grizzlyoflight said :)

By the way, welcome to GTG iluvwaffle3.

grizzlyoflight, did you go through the previous set of instructions yet?
  • 0

#13
grizzlyoflight
Posted 12 October 2005 - 11:17 PM

grizzlyoflight

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
deleted both.


DBNDLL32. EXE
Ran the above. Said it found 2 instances...but could not open into wordpad due to:

Script: C:\documents and Settings\Steve\Desktop\RegSrch.vbs
Line: 76
Char: 1
Error: The system can not find the specified file
Code: 80070002
Source: (null)

MSEDSPL.EXE
No Instances

Edited by grizzlyoflight, 12 October 2005 - 11:28 PM.

  • 0

#14
greyknight17
Posted 12 October 2005 - 11:40 PM

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
OK, we'll do this manually then.

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. While in the Registry Editor, go to Edit->Find and try searching for those two files I asked you to look for. Once found, I want you to go to File->Export and save it (call it something like DBNDLL32-1, just tag it somehow so you recognize it). Then hit F3 key to do a Find Next to make sure there are no more instances of that file. If another one is found, export that also.

When you are done, right click on those saved files (do this one by one) and go to Edit. Copy and paste each of those files here. I will take a look at them.
  • 0

#15
grizzlyoflight
Posted 13 October 2005 - 09:04 AM

grizzlyoflight

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
DBNDLL32.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="MSEDISPL.exe"
"001"="DBNDLL32.exe"
"002"="msdirect"
"003"="msdirectx"


msdirect.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="MSEDISPL.exe"
"001"="DBNDLL32.exe"
"002"="msdirect"
"003"="msdirectx"

msdirectx.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="MSEDISPL.exe"
"001"="DBNDLL32.exe"
"002"="msdirect"
"003"="msdirectx"

MSEDSPL.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="MSEDISPL.exe"
"001"="DBNDLL32.exe"
"002"="msdirect"
"003"="msdirectx"
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP