[binsch]

recently my sister got an im and went to a website url which loaded freepod and everything else onto it. i tried to delete most of it using adaware se, microsoft antispyware beta, and hijack this. but today i clicked on mozilla firefox and it wasnt going online. i checked and it is the only computer in my house that has no internet connection and i am afraid that some junk might still be on my computer. here is my hijackthis log (im using another computer to write this message)


Logfile of HijackThis v1.98.2
Scan saved at 2:49:17 PM, on 10/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\system32\sessmgr.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\Program Files\Security Software Systems\Cyber Sentinel 2.0\enginecs2.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\autodown.exe
C:\temp\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$N4EBE~1\msvcmc.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - (no file)
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [enginecs2] C:\Program Files\Security Software Systems\Cyber Sentinel 2.0\enginecs2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [c32cs2] C:\Program Files\Security Software Systems\Cyber Sentinel 2.0\c32cs2.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKCU\..\Run: [Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab

thanks

Edited by binsch, 12 October 2005 - 01:24 PM.

[Advertisements]

Hi and Welcome to G2G

Before attacking an adware/spyware problem with hijackthis make sure you have already run the following tools. Download and update the databases on each program before running.

• Ad-Aware® SE Personal Edition
  *Note* For Ad-AwareSE also install the VX2 Addon Cleaner To run this tool once Adaware is updated click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK" , then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.
  
• Spybot Search & Destroy
• CWShredder

Also make sure you are using the the latest version (1.99.1) of HijackThis and it's installed in it's own folder on the root drive. (C:\HJT)

Please update your version of hijackthis and post another log in this thread. The old version your using doesn't display some important info.

[MicroBell]

Hi and Welcome to G2G

Before attacking an adware/spyware problem with hijackthis make sure you have already run the following tools. Download and update the databases on each program before running.

• Ad-Aware® SE Personal Edition
  *Note* For Ad-AwareSE also install the VX2 Addon Cleaner To run this tool once Adaware is updated click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK" , then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.
  
• Spybot Search & Destroy
• CWShredder

Also make sure you are using the the latest version (1.99.1) of HijackThis and it's installed in it's own folder on the root drive. (C:\HJT)

Please update your version of hijackthis and post another log in this thread. The old version your using doesn't display some important info.

[binsch]

I installed all of the programs and ran them here is the hijack this log.

Oh and by the way thank you very much for your time

Logfile of HijackThis v1.99.1
Scan saved at 2:34:33 PM, on 10/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.c...i...&zy=l&hl=en
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - (no file)
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [enginecs2] C:\Program Files\Security Software Systems\Cyber Sentinel 2.0\enginecs2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [c32cs2] C:\Program Files\Security Software Systems\Cyber Sentinel 2.0\c32cs2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O20 - Winlogon Notify: msvcmc - C:\WINDOWS\$N4EBE~1\msvcmc.dll (file missing)
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

[MicroBell]

As you had the Vundo infection on your first log..and have a partial entry on your second..I'm going to include it's fix. Some of the other tools we used..may have removed it partially...but lets be sure.

Please DISABLE spybot's teatimer and LEAVE IT OFF until the fix is complete!

Download and install Cleanup but DO NOT run it yet!


*WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility

Download, install, and update Ewido Security Suite

• Install ewido security suite
• Launch ewido, there should be a big E icon on your desktop, double-click it.
• The program will prompt you to update click the OK button
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Click on Start

The update will start and a progress bar will show the updates being installed.
After the updates are installed, exit Ewido

Please print these instructions out for use in Safe Mode.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning.
  It should look like this
  

  VundoFix V2.15 by Atri
  By using VundoFix you agree that you are doing so at your own risk
  Press enter to continue....
  
  

  
  
  
  
• At this point press enter one time.
  
  
  
  
• Next you will see:
  

  Please Type in the filepath as instructed by the forum staff
  and then press enter:

  
  
  
  
• At this point please type the following file path (make sure to enter it exactly as below!):
  
  
  • C:\WINDOWS\$N4EBE~1\msvcmc.dll
  
  
  
  
  
  
• Press Enter to continue with the fix.
  
  
  
  
• Next you will see:
  

  Please type in the second filepath as instructed by the forum
  staff then press enter:

• At this point please type the following file path (make sure to enter it exactly as below!):
  
  C:\WINDOWS\$N4EBE~1\cmcvsm.*
  
  This will be the vundo filename spelt backwards.
• Press Enter to continue with the fix.
• The fix will run then HijackThis will open, if it does not open automatically please open it manually.
• In HiJackThis, please place a check next to the following items and click FIX CHECKED:
  O3 - Toolbar: (no name) - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - (no file)
  O20 - Winlogon Notify: msvcmc - C:\WINDOWS\$N4EBE~1\msvcmc.dll (file missing)
  
• After you have fixed these items, close Hijackthis.
• Press enter to exit the program then manually reboot your computer.
• Once your machine reboots please continue with the instructions below.

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "Options..."
*Move the arrow down to "Custom CleanUp!"
*Put a check next to the following:

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
  [X]Scan local drives for temporary files (Please uncheck this option)
• Cleanup! All Users

Click OK
Press the CleanUp! button to start the program. Reboot/logoff when prompted.



Reboot into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.

Run Ewido:

• Click [Scanner]
• Click [Complete System Scan] to begin scanning.
• Click [OK] when prompted to clean files
• With the first file it prompts to clean, select the option - "Perform action on all infections" - & choose clean and click [OK].
• Once finished, click the [Save report] button
• Save the report to your desktop

Close Ewido

Reboot back to normal windows....

Please run an online scan at http://www.pandasoft.../activescan.htm
Make sure you click the ”Free Online Virus Scan” in the upper right hand corner of the page under the Free use Activescan header. We do NOT want the default spyXposer scan.
Once it has finished save the activescan log.

Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder and the Ewido log.

So I Need.....

Ewido Log
Panda Log
Hijackthis log
Vundofix log

Edited by MicroBell, 23 October 2005 - 03:09 PM.

[binsch]

just a quick question. How do you tell if you have a 64 bit operating system

[MicroBell]

Don't worry about it. If you had to ask...you don't. Go ahead and run the fix.

[binsch]

here are all the logs and i also wanted you to know that i wont be able to be online till wednesday night. here they are

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 11:18:42 AM, 10/24/2005
+ Report-Checksum: 80A97D32

+ Scan result:

HKLM\SOFTWARE\Classes\Interface\{20D21E02-8C1C-41FE-9826-DAB4C223436C} -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{20D21E02-8C1C-41FE-9826-DAB4C223436C}\TypeLib\\ -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{66291BEF-C867-43C0-A7B4-D13393814BCD} -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{66291BEF-C867-43C0-A7B4-D13393814BCD}\TypeLib\\ -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8578D35E-C6C0-4808-9A80-0F6C29A2C423} -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8578D35E-C6C0-4808-9A80-0F6C29A2C423}\TypeLib\\ -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{9DD19D39-2CDC-465B-BB21-1D433590BA3D} -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{9DD19D39-2CDC-465B-BB21-1D433590BA3D}\TypeLib\\ -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{A1772E14-9291-454E-AEDE-02161FBC3E59} -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{A1772E14-9291-454E-AEDE-02161FBC3E59}\TypeLib\\ -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{BC190DA5-0187-4D99-B3AC-6C45EA1B9324} -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{BC190DA5-0187-4D99-B3AC-6C45EA1B9324}\TypeLib\\ -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{5BA32D9E-F1BD-476C-AD42-97C9379A57A4} -> Spyware.HotBar : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{B195B3B3-8A05-11D3-97A4-0004ACA6948E} -> Spyware.HotBar : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{B195B3B3-8A05-11D3-97A4-0004ACA6948E} -> Spyware.HotBar : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000EF1-0786-4633-87C6-1AA7A44296DA} -> Spyware.FavoriteMan : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{13197ACE-6851-45C3-A7FF-C281324D5489} -> Spyware.2nsSearch : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2A8A997F-BB9F-48F6-AA2B-2762D50F9289} -> Spyware.SmartShopper : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{36A59337-6EEF-40AE-94B1-ED443A0C4740} -> Spyware.BetterInternet : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Spyware.NewDotNet : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{69FD62B1-0216-4C31-8D55-840ED86B7C8F} -> Spyware.HotBar : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{75D2080B-4857-4B96-9B7D-732634FBD01F} -> Spyware.HotBar : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82315A18-6CFB-44A7-BDFD-90E36537C252} -> Spyware.NewDotNet : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B195B3B3-8A05-11D3-97A4-0004ACA6948E} -> Spyware.HotBar : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E0CE16CB-741C-4B24-8D04-A817856E07F4} -> Spyware.Roimoi : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\ShopperReports -> Spyware.HotBar : Cleaned with backup
HKU\S-1-5-21-1343024091-1708537768-1060284298-1004\Software\ShopperReports\cs -> Spyware.HotBar : Cleaned with backup
:mozilla.10:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.11:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.12:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.13:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.18:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.23:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.24:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.25:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.26:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.27:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.28:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.29:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.30:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.31:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.36:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.37:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.38:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.39:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.40:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.41:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.42:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.43:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.62:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.63:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.64:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.65:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.66:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.68:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.71:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.73:C:\Documents and Settings\leon\Application Data\Mozilla\Firefox\Profiles\kkrejplu.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.17:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.21:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.23:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.24:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.25:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.26:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.27:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.28:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.29:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.37:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.38:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.44:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.45:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.46:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.47:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.50:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.51:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.61:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.62:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.63:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.64:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Bluemountain : Cleaned with backup
:mozilla.65:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Bluemountain : Cleaned with backup
:mozilla.66:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Bluemountain : Cleaned with backup
:mozilla.67:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Bluemountain : Cleaned with backup
:mozilla.69:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.70:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.71:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.72:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.73:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.77:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.81:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.88:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.89:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.90:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.93:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.94:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.95:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.96:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.97:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.99:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.100:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.102:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.103:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.104:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.105:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.106:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.107:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.136:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.137:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.141:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.142:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.146:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.147:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.161:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.162:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.165:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.172:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.188:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.200:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.201:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.202:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.203:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.204:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.205:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.237:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.239:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.240:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.241:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.248:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.249:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.250:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.258:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
:mozilla.278:C:\Documents and Settings\rebecca\Application Data\Mozilla\Firefox\Profiles\x8e1tmof.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.12:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.13:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.15:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.16:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.17:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.18:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.19:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.20:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.23:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.24:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.25:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.26:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.27:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.28:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.29:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.30:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.31:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.32:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.33:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.34:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.35:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.36:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.43:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.53:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.54:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.55:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.56:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.57:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.58:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.59:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.61:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.67:C:\Documents and Settings\yonatan\Application Data\Mozilla\Firefox\Profiles\dy9gvban.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Program Files\Common Files\system32.dll/gui.exe -> TrojanDownloader.Agent.rv : Cleaned with backup
C:\Program Files\FileSubmit\Space Flight\NNEZTA388.exe -> Spyware.NewDotNet : Cleaned with backup
C:\Program Files\FileSubmit\Space Flight\TBEZA127Q.exe -> Spyware.Quick : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\D08CF048-240B-40D7-8AA1-6B57DA\BF4603AC-F886-4545-932E-8B9167 -> Spyware.HotBar : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\D08CF048-240B-40D7-8AA1-6B57DA\D7CDA118-356D-4671-AE65-C043BC -> Spyware.HotBar : Cleaned with backup
C:\Program Files\Symantec\pcAnywhere\WinNTAuth.dll -> Dialer.Generic : Cleaned with backup
C:\RECYCLER\S-1-5-21-1343024091-1708537768-1060284298-1007\Dc1.cab/fckec980.dll -> TrojanDownloader.Rameh.b : Cleaned with backup


::Report End




Incident Status Location

Adware:Adware/Maxifiles No disinfected C:\Documents and Settings\rebecca\mc-110-12-0000080.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\System\Mapi\1033\mc-110-12-0000080.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\DNS\cwebpage.dll
Adware:Adware/TopRebates No disinfected C:\WINDOWS\iNetPal\ezTSetup.exe




Logfile of HijackThis v1.99.1
Scan saved at 1:24:55 PM, on 10/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.c...i...&zy=l&hl=en
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - (no file)
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [enginecs2] C:\Program Files\Security Software Systems\Cyber Sentinel 2.0\enginecs2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [c32cs2] C:\Program Files\Security Software Systems\Cyber Sentinel 2.0\c32cs2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: msvcmc - C:\WINDOWS\$N4EBE~1\msvcmc.dll (file missing)
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe




VundoFix V2.15 by Atri
--------------------------------------------------------------------------------------

Listing files contained in the vundofix folder.
--------------------------------------------------------------------------------------

killvundo.bat
process.exe
ReadMe.txt
vundo.reg
vundofix.txt

--------------------------------------------------------------------------------------

Filepaths entered
--------------------------------------------------------------------------------------

The filepath entered was C:\WINDOWS\$N4EBE~1\cmcvsm.*

The second filepath entered was

--------------------------------------------------------------------------------------

Log from Process
--------------------------------------------------------------------------------------


Killing PID 132 'smss.exe'

Killing PID 740 'explorer.exe'
Killing PID 740 'explorer.exe'


Killing PID 208 'winlogon.exe'
--------------------------------------------------------------------------------------

C:\WINDOWS\$N4EBE~1\cmcvsm.* Deleted sucessfully.

Fixing Registry
--------------------------------------------------------------------------------------

and thanks again for your time and help

[MicroBell]

Please follow my instructions as indicated.

a. Looks like you entered the wrong filenames in the wrong places on the Vundo fix
b. Spybot is running in your second log when I asked you to disable it until we are done.

Please DISABLE spybot's teatimer and LEAVE IT OFF until the fix is complete!

Rerun the Vundo fix..and put the correct file paths into the correct locations.

Once that's finished...run hijackthis and fix the following entrys if still listed.

O3 - Toolbar: (no name) - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - (no file)
O20 - Winlogon Notify: msvcmc - C:\WINDOWS\$N4EBE~1\msvcmc.dll (file missing)


Reboot into safe mode. Open add/remove programs and remove DNS and iNEtPal IF listed.


C:\Program Files\DNS <--delete that folder

C:\WINDOWS\iNetPal <---delete that folder

C:\WINDOWS\$N4EBE~1\msvcmc.dll <---check and make sure that files deleted

C:\Documents and Settings\rebecca\mc-110-12-0000080.exe <--delete that file

C:\Program Files\Common Files\System\Mapi\1033\mc-110-12-0000080.exe <--delete that file


Run the Cleanup utility again and reboot/logoff when prompted.

Once back in normal windows...run another Panda scan..and post it's log along with a new hijackthis log.

[binsch]

how do you disable sbybots teatimer because everytime i exit it it goes back on the next restart.

thanks again

[binsch]

nevermind i think i figured it out

[binsch]

when i press enter the fist time in vundofix it tells me this

A file critical to VundoFix is missing please re-download VundoFix.exe
from: http://www.atribune....ds/VundoFix.exe
Run it and let it re-extract to its default folder.
Then continue with your helpers instructions.
Please press enter to exit.

what should i do

[binsch]

um well you havent answered me for 2 weeks was this forum deleted

[MicroBell]

binsch,

As this isn't my home forum and I only visit when not 'Swamped' at the other. Anyway...you waited 3 days to reply back and I lost track of your thread. Please post a new hijackthis log since it's been so long and we will continue.