[greeneyedgrim]

Hey all,
I was wondering if anyone would be able to guide me through this problem that I seem to be having. About 3-4 days ago I got these pop-ups on the lower right tool bar saying that my computer is infected and that I have 4 adware programs on it and they need to be removed, I used my own adware and virus scans and came up with nothing unusual (low threat). After multiple tries to locate and remove SpyAxe, it keeps regenerating and insists on not being deleted. I downloaded the suggested files in the "before you start" area, and still have the pop ups and malware apparently. I did the sweeps, shreds, and everything else. I could not download SP1a because it said I had a more current version and would not allow me to DL. Here are my logs...

Logfile of HijackThis v1.99.1
Scan saved at 10:58:07 PM, on 11/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\PROGRA~1\Simply\CBWAttn.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\essspk.exe
C:\PROGRA~1\Simply\Cheymon.exe
C:\Program Files\Iomega HotBurn\Autolaunch.exe
C:\WINDOWS\System32\r3proxy.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Simply\CBWHost.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe
C:\Program Files\SpyAxe\spyaxe.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\SpyAxe\spyaxe.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\AOL\1132633144\ee\AOLHostManager.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\AOL\1132633144\ee\AOLServiceHost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\system32\cidaemon.exe
C:\DOCUMENTS AND SETTINGS\WILL\DESKTOP\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: HomepageBHO - {7caf96a2-c556-460a-988e-76fc7895d284} - C:\WINDOWS\system32\hp9F40.tmp (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (file missing)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [SFPrnmon] C:\PROGRA~1\Simply\Cheymon.exe
O4 - HKLM\..\Run: [CBWUser] "C:\Program Files\Simply\CBWUser.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [Fellowes Proxy] C:\WINDOWS\System32\r3proxy.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [dEn] C:\documents and settings\will\local settings\temp\dEn.exe
O4 - HKLM\..\Run: [YHGSovI] c:\documents and settings\will\local settings\temp\YHGSovI.exe
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe -s
O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor
O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1132633144\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [SpyAxe] C:\Program Files\SpyAxe\spyaxe.exe /h
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Aloo] "C:\Program Files\ewrc\rose.exe" -vt mt
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.a...83/mcinsctl.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.a...,20/mcgdmgr.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: CBWAttn - ACCPAC International, Inc. - C:\PROGRA~1\Simply\CBWAttn.exe
O23 - Service: CBWHost - ACCPAC International, Inc. - C:\PROGRA~1\Simply\CBWHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



Thank you for any and all help

[Advertisements]

Welcome greeneyedgrim to Geeks to Go!

Please read these instructions carefully. You may want to print them. Copy the text to a Notepad file and save it to your desktop! We will need the file later.
Be sure to follow ALL instructions!

***

I see that you have Spy Fighter. This is considered a rogue program. I recommend you uninstall it.

Move to Start > Settings > Control Panel
Double click Add/Remove Programs.
Within Add/Remove programs click the "Install/Uninstall" tab or click the "Change or Remove Programs" button.
Within this section you will see a listing of programs that are currently installed that support this feature. If the program I’m advising you to uninstall is listed within this list, highlight it and click the Add/Remove or uninstall option or button.

***

Please download noahdfear's smitRem.exe©. Save the file to your desktop. Double click on the file to extract it to it's own folder on the desktop.

***

Download SpyAxeFix.exe © noahdfear. Save it to your desktop.

***

Launch ewido, there should be an icon on your desktop double-click it.

The program will now go to the main screen
You will need to update ewido to the latest definition files.On the left hand side of the main screen click update
Click on Start
The update will start and a progress bar will show the updates being installed.
Once the updates are installed, close Ewido for now.

***

Update AdAware SE 1.06 to the latest definitions.

***

Download the Killbox.
Unzip it to the desktop

Double-click on Killbox.exe to run it. Place the following lines (complete paths) in bold in the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each

C:\documents and settings\will\local settings\temp\dEn.exe
c:\documents and settings\will\local settings\temp\YHGSovI.exe
C:\Program Files\ewrc\rose.exe

For these file, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

If your computer does not restart automatically, please restart it manually.

***

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

***

Open HijackThis
Place a check against each of the following, making sure you get them all and not any others by mistake:

O2 - BHO: HomepageBHO - {7caf96a2-c556-460a-988e-76fc7895d284} - C:\WINDOWS\system32\hp9F40.tmp (file missing)

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (file missing)

O4 - HKLM\..\Run: [dEn] C:\documents and settings\will\local settings\temp\dEn.exe

O4 - HKLM\..\Run: [YHGSovI] c:\documents and settings\will\local settings\temp\YHGSovI.exe

O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor

O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent

O4 - HKCU\..\Run: [Aloo] "C:\Program Files\ewrc\rose.exe" -vt mt

Close all programs leaving only HijackThis running.
Click on Fix Checked when finished and exit HijackThis.

***

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed.
Post me the contents of the smitfiles.txt log as you post back.

***

Close all other programs and windows. Double click SpyAxeFix.exe, then click Start to extract the tool to it's own folder. Open the SpyAxeFix folder and double click the SpyAxeFix.bat to start the tool. At one point when the tool runs, your taskbar will dissappear, and your computer will restart when the tool completes. A text file named spyaxe.txt will be created in the SpyAxeFix folder. Post the contents of that log please.

***

Open Ad-aware and do a full scan. Remove all it finds.

***

Now open Ewido Security Suite:* Click on scanner
* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop
Reboot your computer.

***

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

***

Reboot back into Windows
[/list]Please post:
a new HijackThis Log
the contents of smitfiles.txt
the contents of spyaxe.txt
and the Ewido Log by using Add Reply.

Edited by g2i2r4, 26 November 2005 - 06:53 AM.

[g2i2r4]

Welcome greeneyedgrim to Geeks to Go!

Please read these instructions carefully. You may want to print them. Copy the text to a Notepad file and save it to your desktop! We will need the file later.
Be sure to follow ALL instructions!

***

I see that you have Spy Fighter. This is considered a rogue program. I recommend you uninstall it.

Move to Start > Settings > Control Panel
Double click Add/Remove Programs.
Within Add/Remove programs click the "Install/Uninstall" tab or click the "Change or Remove Programs" button.
Within this section you will see a listing of programs that are currently installed that support this feature. If the program I’m advising you to uninstall is listed within this list, highlight it and click the Add/Remove or uninstall option or button.

***

Please download noahdfear's smitRem.exe©. Save the file to your desktop. Double click on the file to extract it to it's own folder on the desktop.

***

Download SpyAxeFix.exe © noahdfear. Save it to your desktop.

***

Launch ewido, there should be an icon on your desktop double-click it.

The program will now go to the main screen
You will need to update ewido to the latest definition files.On the left hand side of the main screen click update
Click on Start
The update will start and a progress bar will show the updates being installed.
Once the updates are installed, close Ewido for now.

***

Update AdAware SE 1.06 to the latest definitions.

***

Download the Killbox.
Unzip it to the desktop

Double-click on Killbox.exe to run it. Place the following lines (complete paths) in bold in the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each

C:\documents and settings\will\local settings\temp\dEn.exe
c:\documents and settings\will\local settings\temp\YHGSovI.exe
C:\Program Files\ewrc\rose.exe

For these file, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

If your computer does not restart automatically, please restart it manually.

***

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

***

Open HijackThis
Place a check against each of the following, making sure you get them all and not any others by mistake:

O2 - BHO: HomepageBHO - {7caf96a2-c556-460a-988e-76fc7895d284} - C:\WINDOWS\system32\hp9F40.tmp (file missing)

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (file missing)

O4 - HKLM\..\Run: [dEn] C:\documents and settings\will\local settings\temp\dEn.exe

O4 - HKLM\..\Run: [YHGSovI] c:\documents and settings\will\local settings\temp\YHGSovI.exe

O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor

O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent

O4 - HKCU\..\Run: [Aloo] "C:\Program Files\ewrc\rose.exe" -vt mt

Close all programs leaving only HijackThis running.
Click on Fix Checked when finished and exit HijackThis.

***

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed.
Post me the contents of the smitfiles.txt log as you post back.

***

Close all other programs and windows. Double click SpyAxeFix.exe, then click Start to extract the tool to it's own folder. Open the SpyAxeFix folder and double click the SpyAxeFix.bat to start the tool. At one point when the tool runs, your taskbar will dissappear, and your computer will restart when the tool completes. A text file named spyaxe.txt will be created in the SpyAxeFix folder. Post the contents of that log please.

***

Open Ad-aware and do a full scan. Remove all it finds.

***

Now open Ewido Security Suite:* Click on scanner
* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop
Reboot your computer.

***

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

***

Reboot back into Windows
[/list]Please post:
a new HijackThis Log
the contents of smitfiles.txt
the contents of spyaxe.txt
and the Ewido Log by using Add Reply.

Edited by g2i2r4, 26 November 2005 - 06:53 AM.

[greeneyedgrim]

Ok, followed all directions as you said. There was a file that I could not locate in HijackThis..."O4 - HKCU\..\Run: [Aloo] "C:\Program Files\ewrc\rose.exe" -vt mt".
Other than that here are my logs...


smitRem © log file
version 2.7

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
The current date is: Sat 11/26/2005
The current time is: 15:29:22.34

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

Security Toolbar


~~~ Shortcuts ~~~

Online Security Center.url


~~~ Favorites ~~~



~~~ system32 folder ~~~

1024 dir
ncompat.tlb
nvctrl.exe


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

CLEAN!



SpyAxeFix © by noahdfear


Microsoft Windows XP [Version 5.1.2600]
The current date is: Sat 11/26/2005
The current time is: 15:39:15.00

spyaxe directory present

spyaxe uninstaller present

Starting spyaxe uninstaller

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Error, Cannot find a process with an image name of spyaxe.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1732 'explorer.exe'
Killing PID 1732 'explorer.exe'


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Error, Cannot find a process with an image name of rundll32.exe

svchosts.dll present

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"


---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 4:23:38 PM, 11/26/2005
+ Report-Checksum: D60370BC

+ Scan result:

:mozilla.18:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Adorigin : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Adorigin : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Adorigin : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Adorigin : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.110:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.115:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.116:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.117:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.132:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.148:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.154:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.160:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.164:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
:mozilla.168:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Findwhat : Cleaned with backup
:mozilla.226:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Ivwbox : Cleaned with backup
:mozilla.247:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.282:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.283:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Paycounter : Cleaned with backup
:mozilla.290:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.296:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.297:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.298:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.315:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.316:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.323:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.324:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.325:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.326:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.327:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.328:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.329:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.330:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.331:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.349:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.350:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.351:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.352:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.355:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.356:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.364:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.378:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.379:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.395:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.396:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.397:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.398:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.404:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.405:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.406:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.407:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.424:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.425:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.452:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Masterstats : Cleaned with backup
:mozilla.492:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.493:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.494:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.498:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.499:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.500:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.538:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
:mozilla.539:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.574:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.575:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.576:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.577:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP103\A0028230.dll -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP103\A0028231.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP104\A0028532.DLL -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP107\A0028804.dll -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP109\A0029844.exe -> Spyware.MediaTickets : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP110\A0030350.exe -> Spyware.MediaTickets : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP113\A0030677.dll -> Adware.SpySheriff : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP117\A0031684.exe -> Not-A-Virus.Hoax.Renos.b : Cleaned with backup
C:\System Volume Information\_restore{EA956626-FEE5-42D2-AF39-E6BD363429F2}\RP117\A0031692.EXE -> TrojanDownloader.Zlob.bj : Cleaned with backup


::Report End


Logfile of HijackThis v1.99.1
Scan saved at 3:23:12 PM, on 11/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Will\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: HomepageBHO - {7caf96a2-c556-460a-988e-76fc7895d284} - C:\WINDOWS\system32\hp9F40.tmp (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [SFPrnmon] C:\PROGRA~1\Simply\Cheymon.exe
O4 - HKLM\..\Run: [CBWUser] "C:\Program Files\Simply\CBWUser.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [Fellowes Proxy] C:\WINDOWS\System32\r3proxy.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [dEn] C:\documents and settings\will\local settings\temp\dEn.exe
O4 - HKLM\..\Run: [YHGSovI] c:\documents and settings\will\local settings\temp\YHGSovI.exe
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe -s
O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor
O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1132633144\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [SpyAxe] C:\Program Files\SpyAxe\spyaxe.exe /h
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.a...83/mcinsctl.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.a...,20/mcgdmgr.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: CBWAttn - ACCPAC International, Inc. - C:\PROGRA~1\Simply\CBWAttn.exe
O23 - Service: CBWHost - ACCPAC International, Inc. - C:\PROGRA~1\Simply\CBWHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[g2i2r4]

I hope you removed SpyFighter.

Let's remove what's left.

Please disable Spyware Doctor, as it may interfere with the fix. To disable Spyware Doctor:

• Click the Spyware Doctor icon in the System Tray.
• Click Settings.
• Click Startup Settings under Pick a Category.
• Uncheck Run at Windows startup.
• Click Apply and Exit Spyware Doctor

Once your log is clean you can re-enable Spyware Doctor.

***

Double-click on Killbox.exe to run it. Place the following lines (complete paths) in bold in the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each

C:\documents and settings\will\local settings\temp\dEn.exe
c:\documents and settings\will\local settings\temp\YHGSovI.exe
C:\Program Files\SpyFighter\SpyFighter.exe
C:\Program Files\SpyFighter\AutoUpdate.exe
C:\Program Files\SpyAxe\spyaxe.exe
C:\WINDOWS\system32\svchosts.dll

For these files, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.
Click "No" at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually.

***

Open HijackThis
Place a check against each of the following, making sure you get them all and not any others by mistake:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - Default URLSearchHook is missing

O2 - BHO: HomepageBHO - {7caf96a2-c556-460a-988e-76fc7895d284} - C:\WINDOWS\system32\hp9F40.tmp (file missing)

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)

O4 - HKLM\..\Run: [dEn] C:\documents and settings\will\local settings\temp\dEn.exe

O4 - HKLM\..\Run: [YHGSovI] c:\documents and settings\will\local settings\temp\YHGSovI.exe

O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor

O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent

O4 - HKLM\..\Run: [SpyAxe] C:\Program Files\SpyAxe\spyaxe.exe /h

Close all programs leaving only HijackThis running.
Click on Fix Checked when finished and exit HijackThis.

***

Use Windows Explorer to delete these folders:
C:\WINDOWS\system32\1024\
C:\Program Files\SpyAxe\
C:\Program Files\SpyFighter\
C:\Program Files\ewrc\

***

Reboot the computer.

***

Rerun Ewido and save the log.

Please post me a fresh HijackThis log and the Ewido log.

[greeneyedgrim]

Hey,
I followed the directions that you gave me but I had some problems with them...
First, I couldn't find anything called spyware doctor anywhere in the system try...
Second, after running killbox, I couldn't find any of the lines that you provided...
Third, same thing for Hijackthis, none of the files listed were there...
and lastly, the lines given for Windows explorer were not found. I honestly don't know what all that means if anything, or maybe I'm missing something, I have no clue.

Logfile of HijackThis v1.99.1
Scan saved at 11:31:02 PM, on 11/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\PROGRA~1\Simply\CBWAttn.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Simply\CBWHost.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\essspk.exe
C:\PROGRA~1\Simply\Cheymon.exe
C:\Program Files\Iomega HotBurn\Autolaunch.exe
C:\WINDOWS\System32\r3proxy.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\AOL\1132633144\ee\AOLHostManager.exe
C:\Program Files\Common Files\AOL\1132633144\ee\AOLServiceHost.exe
C:\Program Files\Common Files\AOL\1132633144\ee\AOLServiceHost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\ewido\security suite\securitysuite.exe
C:\Documents and Settings\Will\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [SFPrnmon] C:\PROGRA~1\Simply\Cheymon.exe
O4 - HKLM\..\Run: [CBWUser] "C:\Program Files\Simply\CBWUser.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [Fellowes Proxy] C:\WINDOWS\System32\r3proxy.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe -s
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1132633144\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Aloo] "C:\Program Files\ewrc\rose.exe" -vt mt
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.a...83/mcinsctl.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.a...,20/mcgdmgr.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: CBWAttn - ACCPAC International, Inc. - C:\PROGRA~1\Simply\CBWAttn.exe
O23 - Service: CBWHost - ACCPAC International, Inc. - C:\PROGRA~1\Simply\CBWHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe





---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 12:57:03 AM, 11/28/2005
+ Report-Checksum: 72D60852

+ Scan result:

:mozilla.6:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Paycounter : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Will\Application Data\Mozilla\Firefox\Profiles\x8dr96n8.Will\cookies.txt -> Spyware.Cookie.Sexlist : Cleaned with backup


::Report End

[g2i2r4]

Open HijackThis
Place a check against each of the following, making sure you get them all and not any others by mistake:

O4 - HKCU\..\Run: [Aloo] "C:\Program Files\ewrc\rose.exe" -vt mt

Close all programs leaving only HijackThis running.
Click on Fix Checked when finished and exit HijackThis.

***

We need to make sure all hidden files are showing so please:* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
Reverse the process when you are done.

***

Please remove this folder:
C:\Program Files\ewrc\

***

Reboot the computer.

***

Run the Panda free use Active Scan.
You need to use Internet Explorer for this scan.

• Click on Check Now!
• A new window will appear; fill in the boxes (Country, State, email addy)
• Click on Scan Now! >
  If you have never used ActiveScan before, you will be prompted to install an ActiveX control (asinst.cab) : click on Install. Panda will install the component, and then install the latest signature files.
• From "Select a device to scan...", choose "My Computer"
• Allow the scan to run. It'll take a while.
• When complete, click on "See Report", and then on "Save report"; save it to a convenient location.
• I will need you to post that report in your next reply; simply open the text file, then copy/paste the content here.

[greeneyedgrim]

Incident Status Location


Adware:adware/ist.istbar Not disinfected C:\PROGRAM FILES\COMMON FILES\Totem Shared
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-96d30d8-3556835c.zip[GetAccess.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-96d30d8-3556835c.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-96d30d8-3556835c.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-96d30d8-3556835c.zip[Installer.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7c9c1f18-35fac8f7.zip[BlackBox.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7c9c1f18-35fac8f7.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7c9c1f18-35fac8f7.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7c9c1f18-35fac8f7.zip[Beyond.class]
Adware:Adware/IST.ISTBar Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3cc46f89-430ed60d.zip[InstallerApplet.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\kartinka.jar-61f8059b-1307639c.zip[GetAccess.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\kartinka.jar-61f8059b-1307639c.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\kartinka.jar-61f8059b-1307639c.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\kartinka.jar-61f8059b-1307639c.zip[Installer.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-da4ff31-10af9ba8.zip[GetAccess.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-da4ff31-10af9ba8.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-da4ff31-10af9ba8.zip[Dummy.class]
Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Will\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-da4ff31-10af9ba8.zip[Installer.class]
Adware:Adware/WinTools Not disinfected C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0805200518444570241.asw
Adware:Adware/WinTools Not disinfected C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0805200518444570241.asw[WToolsD.cfg]
Adware:Adware/WinTools Not disinfected C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0805200518444570471.asw
Adware:Adware/WinTools Not disinfected C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0805200518444570471.asw[WToolsD.cfg]
Adware:Adware/WinTools Not disinfected C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0925200523512702215.asw
Adware:Adware/PurityScan Not disinfected C:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle1011200522155302494.asw

[g2i2r4]

Clean up the backup within AOL Spyware Protection.

***

Use Windows Explorer to remove this folder:
C:\PROGRAM FILES\COMMON FILES\Totem Shared

***

Move to Start > Settings > Control Panel
Set the view to 'classic'
Open Java Consol
Clear the cache or remove the temporary files (depending on the version you use)
Close Java Consol
Reset the view to 'category'
Close all windows.

***

Is the computer running OK now?

[greeneyedgrim]

ok I cleared the Cache from Java, and removed the program log, and cleaned out Aol's spyware checker, but it seems the computer is running slower than it was before this problem happened. I did a defrag and disk cleanup and nothing really changed. Main problem is when screen saver comes on takes 1-2 minutes for it to go back to windows, and if more than one program is running it takes a lot longer than usual to open a browser page or to exit out of a window... don't know if any of this is inter-related?
Otherwise the computer is fine, no more pop-ups from spyaxe and no more "your computer is infected" balloons. The only issue that I have now is the speed or performance...

Thank you for all of your help, I greatly appreciate all your valuable time helping me.

[g2i2r4]

Sometimes Ewido can slow down your computer. You could try to disable it or uninstall it.

As you startup, look at all the programs running. Ask yourself if you really need them running all the time.


EDIT:
As there has been no reply from the original poster for ten days this topic is now closed.

If you are the original poster and still need assistance, please send me a PM.

Edited by g2i2r4, 15 December 2005 - 03:17 PM.