[X_poison_girl_x]

Logfile of HijackThis v1.99.1
Scan saved at 7:44:49 AM, on 1/4/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\TOOLS\spyware tools\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll
O3 - Toolbar: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1115336617718
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D6CC0022-69AF-4708-9957-20ED3BB74229}: NameServer = 66.73.20.40 206.141.193.55
O23 - Service: CIJ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Owner\LOCALS~1\Temp\CIJ.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: FMQPLXB - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Owner\LOCALS~1\Temp\FMQPLXB.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: SmartFinder Uninstall (SmartFinder_Uninstall) - Unknown owner - C:\Documents and Settings\Owner\Desktop\SFUninstaller.exe" service (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: XIRUBKOVQ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Owner\LOCALS~1\Temp\XIRUBKOVQ.exe



Log of AproposFix v1

************

Running from directory:
C:\Documents and Settings\Owner\Desktop\aproposfix

************

Registry entries found:


************

No service found!

Removing hidden folder:
No folder found!

Deleting files:


Backing up files:
Done!

Removing registry entries:

REGEDIT4


Done!

Finished!

[Advertisements]

Well that didn't find anything and yo still haven't posted a Rookit Revealer log.

Are you still getting popups? If so, describe what kind of popups you are getting please.

Run Rootkit Revealer and post the log please.

[Flrman1]

Well that didn't find anything and yo still haven't posted a Rookit Revealer log.

Are you still getting popups? If so, describe what kind of popups you are getting please.

Run Rootkit Revealer and post the log please.

[X_poison_girl_x]

I can't post the Rootkit Revealer log because its too long and I don't have the power enabled to let me attach it.


I get ads from the following:
888.com casino ads
cheap tickets.com
Winfixer ads that try to trick me into installing stuff
Ads with smileys going crazy
Anytime I google something an ad pops up with search results from 'Search the Web'
i just got an ad from 'Registry Cleaner'
I get some dating ads too

[Flrman1]

Why can't you attach the Rootkit Revealer log? What happens when you try?

[X_poison_girl_x]

"If the admin has enabled it, you will also see a file attachments option, this will allow you to attach a file to be uploaded when making a post. Click the browse button to select a file from your computer to be uploaded. If you upload an image file, it may be shown in the content of the post, all other file types will be linked to. "

When I attach the file, I don't see a link to it.

[Flrman1]

After you click "Browse" and browse to the file then it is dispalyed in the box, you have to click the "Add this attachment" button. Did you do that?

[X_poison_girl_x]

Yea.. But it didn't work.

Edited by X_poison_girl_x, 05 January 2006 - 12:31 PM.

[Flrman1]

Attach a copy of it and send it to me here. Put "Files from G2G" in the Subject line and include a link to this thread so I'll know where it came from.

[Flrman1]

* Click here to download Unhackme.zip.

• Unzip the file to your desktop.
• Doubleclick the unhackme300.exe file to begin the installation.
• Follow the prompts to install it.
• When the installation is complete, unhackme should open.
• Click the "Check Me Now" button.
• Post back here and let us know what it found.

[X_poison_girl_x]

This is what it found.


I tried to delete the file. I got a message saying it would automaticly delete when I restarted, but it didn't happen. I don't understand why it won't delete the file.

[Flrman1]

Did you manually restart and run unhackme again to see if it was still there?

If not, do so please.

[X_poison_girl_x]

I did, but it still didn't delete.

I even tried to manually delete it, but it didn't work

[Flrman1]

Try this:

* Go here and download the Free Trial version of SpySweeper.

• Click on "Download the trial" on the right side of the page.
• Save the ssfsetup file to your desktop or somewhere convenient.
• Doubleclick the ssfsetup file to begin the setup.
• Follow the prompts to complete the installation then click "Finish" and Spysweeper should launch.
• When it first opens, Spysweeper will prompt you to "Check for Updated Definitions"
• Click "Yes" and dowload the updates.
• After the updated definitons are downloaded, click the "Options" button on the left.
• Under "What to Sweep", select ALL the boxes there.
• Click the "Sweep" button on the left then click "Start" to begin the scan.
• When it's finished scanning, click the "Next" button.
• Make sure everything has a check next to it by clicking the "Select All" button.
• Click the "Next" button and it will remove the selected entries.
• Click "Finish" then exit Spysweeper.
• Restart your computer

Come back here and post the SpySweeper scan results.

[Flrman1]

Also tell me if you can find this folder:

C:\Program Files\Acoemule

[X_poison_girl_x]

********
9:54 PM: | Start of Session, Friday, January 06, 2006 |
9:54 PM: Spy Sweeper started
9:54 PM: Sweep initiated using definitions version 597
9:54 PM: Starting Memory Sweep
9:59 PM: Memory Sweep Complete, Elapsed Time: 00:04:36
9:59 PM: Starting Registry Sweep
9:59 PM: Found Adware: adlogix
9:59 PM: HKLM\software\securewin\ (3 subtraces) (ID = 103143)
9:59 PM: Found Adware: bookedspace
9:59 PM: HKLM\software\configuration manager\cfgmgr52\ (121 subtraces) (ID = 104873)
9:59 PM: Found Adware: coolwebsearch (cws)
9:59 PM: HKCR\clsid\{905bd5e4-261c-4efd-5456-cd124d7b9d18}\ (2 subtraces) (ID = 107685)
9:59 PM: HKLM\software\classes\clsid\{905bd5e4-261c-4efd-5456-cd124d7b9d18}\ (2 subtraces) (ID = 109069)
9:59 PM: Found Adware: cws_ns3
9:59 PM: HKCR\clsid\{031788de-6282-f9cd-262a-aa22cda2b068}\ (2 subtraces) (ID = 117649)
9:59 PM: HKCR\clsid\{04cb6006-ab79-1366-4ef1-bff815b874ee}\ (2 subtraces) (ID = 117661)
9:59 PM: HKCR\clsid\{07f0caa0-8206-9dcc-5402-d4cc24ec1764}\ (2 subtraces) (ID = 117686)
9:59 PM: HKCR\clsid\{08a3baae-ceb8-766f-9585-a831a8e94068}\ (2 subtraces) (ID = 117690)
9:59 PM: HKCR\clsid\{5fa0cf1e-5ff7-5212-6d7d-5710e683babb}\ (2 subtraces) (ID = 117913)
9:59 PM: HKCR\clsid\{6d793fe9-8675-897b-589b-5bcab9d3cfef}\ (2 subtraces) (ID = 117949)
9:59 PM: HKCR\clsid\{7a8ec00b-7964-c396-e2f8-621f6c9029fa}\ (2 subtraces) (ID = 117959)
9:59 PM: HKCR\clsid\{22e7067a-283f-cf1c-4373-210a97c38bdb}\ (2 subtraces) (ID = 118105)
9:59 PM: HKCR\clsid\{50b9d537-5db0-52b1-ff6f-ed6c70da477e}\ (2 subtraces) (ID = 118189)
9:59 PM: HKCR\clsid\{3757d8ec-fd1d-a2f5-366b-c8c2fee89b04}\ (2 subtraces) (ID = 118491)
9:59 PM: HKCR\clsid\{5345a51f-e5d0-5a0d-1418-a1c95c417e3c}\ (2 subtraces) (ID = 118506)
9:59 PM: HKCR\clsid\{a97b64ca-35c4-dd86-2890-054ee94ce844}\ (2 subtraces) (ID = 118768)
9:59 PM: HKCR\clsid\{a7737e2c-9c15-d4be-4a5b-c15b7e8c41e9}\ (2 subtraces) (ID = 118787)
9:59 PM: HKCR\clsid\{baa4a995-e881-38f6-1e95-af9f2785fbb3}\ (2 subtraces) (ID = 118904)
9:59 PM: HKCR\clsid\{c092cea0-fb34-5e12-83ed-47942941decc}\ (2 subtraces) (ID = 118940)
9:59 PM: HKCR\clsid\{efc71f6e-8006-6787-aad0-b50964b31181}\ (2 subtraces) (ID = 119335)
9:59 PM: HKLM\software\classes\clsid\{031788de-6282-f9cd-262a-aa22cda2b068}\ (2 subtraces) (ID = 119528)
9:59 PM: HKLM\software\classes\clsid\{04cb6006-ab79-1366-4ef1-bff815b874ee}\ (2 subtraces) (ID = 119539)
9:59 PM: HKLM\software\classes\clsid\{07f0caa0-8206-9dcc-5402-d4cc24ec1764}\ (2 subtraces) (ID = 119562)
9:59 PM: HKLM\software\classes\clsid\{08a3baae-ceb8-766f-9585-a831a8e94068}\ (2 subtraces) (ID = 119566)
9:59 PM: HKLM\software\classes\clsid\{5fa0cf1e-5ff7-5212-6d7d-5710e683babb}\ (2 subtraces) (ID = 119788)
9:59 PM: HKLM\software\classes\clsid\{6d793fe9-8675-897b-589b-5bcab9d3cfef}\ (2 subtraces) (ID = 119823)
9:59 PM: HKLM\software\classes\clsid\{7a8ec00b-7964-c396-e2f8-621f6c9029fa}\ (2 subtraces) (ID = 119833)
9:59 PM: HKLM\software\classes\clsid\{22e7067a-283f-cf1c-4373-210a97c38bdb}\ (2 subtraces) (ID = 119975)
9:59 PM: HKLM\software\classes\clsid\{50b9d537-5db0-52b1-ff6f-ed6c70da477e}\ (2 subtraces) (ID = 120046)
9:59 PM: HKLM\software\classes\clsid\{3757d8ec-fd1d-a2f5-366b-c8c2fee89b04}\ (2 subtraces) (ID = 120338)
9:59 PM: HKLM\software\classes\clsid\{5345a51f-e5d0-5a0d-1418-a1c95c417e3c}\ (2 subtraces) (ID = 120353)
9:59 PM: HKLM\software\classes\clsid\{a97b64ca-35c4-dd86-2890-054ee94ce844}\ (2 subtraces) (ID = 120607)
9:59 PM: HKLM\software\classes\clsid\{a7737e2c-9c15-d4be-4a5b-c15b7e8c41e9}\ (2 subtraces) (ID = 120626)
9:59 PM: HKLM\software\classes\clsid\{baa4a995-e881-38f6-1e95-af9f2785fbb3}\ (2 subtraces) (ID = 120741)
9:59 PM: HKLM\software\classes\clsid\{c092cea0-fb34-5e12-83ed-47942941decc}\ (2 subtraces) (ID = 120776)
9:59 PM: HKLM\software\classes\clsid\{efc71f6e-8006-6787-aad0-b50964b31181}\ (2 subtraces) (ID = 121165)
9:59 PM: Found Adware: cws_tiny0
9:59 PM: HKCR\clsid\{4c1cbc17-3c15-343f-1e7c-d8f447935c05}\ (2 subtraces) (ID = 123839)
9:59 PM: HKLM\software\classes\clsid\{4c1cbc17-3c15-343f-1e7c-d8f447935c05}\ (2 subtraces) (ID = 124074)
9:59 PM: Found Adware: delfin
9:59 PM: HKLM\software\dvx\ (3 subtraces) (ID = 124854)
9:59 PM: HKLM\software\skin\ (ID = 124892)
10:00 PM: Found Trojan Horse: trojan_downloader_tibser
10:00 PM: HKCR\clsid\{28f3e407-f254-5d75-c0d9-a8f22cc3eac5}\ (2 subtraces) (ID = 145076)
10:00 PM: HKCR\clsid\{e4c72eda-8bdb-7d77-0f8c-37f041df909d}\ (4 subtraces) (ID = 145088)
10:00 PM: HKLM\software\classes\clsid\{28f3e407-f254-5d75-c0d9-a8f22cc3eac5}\ (2 subtraces) (ID = 145093)
10:00 PM: HKLM\software\classes\clsid\{e4c72eda-8bdb-7d77-0f8c-37f041df909d}\ (4 subtraces) (ID = 145105)
10:00 PM: Found Adware: websearch toolbar
10:00 PM: HKLM\system\currentcontrolset\enum\root\legacy_wintoolssvc\ (7 subtraces) (ID = 146518)
10:00 PM: Found Adware: command
10:00 PM: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\0000\ (6 subtraces) (ID = 1016064)
10:00 PM: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\ (8 subtraces) (ID = 1016072)
10:00 PM: Found Adware: maxifiles
10:00 PM: HKCR\typelib\{5279231e-fabe-4abf-83a8-7c7e17e3ce1a}\ (9 subtraces) (ID = 1020940)
10:00 PM: HKLM\software\classes\typelib\{5279231e-fabe-4abf-83a8-7c7e17e3ce1a}\ (9 subtraces) (ID = 1021009)
10:00 PM: Found Adware: directrevenue-abetterinternet
10:00 PM: HKU\WRSS_Profile_S-1-5-21-2025429265-1972579041-725345543-500\software\aurora\ (17 subtraces) (ID = 360174)
10:00 PM: Found Adware: drsnsrch.com hijack
10:00 PM: HKU\S-1-5-21-2025429265-1972579041-725345543-1003\software\microsoft\search assistant\ || defaultsearchurl (ID = 128205)
10:00 PM: Found Adware: systemprocess
10:00 PM: HKU\S-1-5-21-2025429265-1972579041-725345543-1003\software\system process\ (1 subtraces) (ID = 860389)
10:00 PM: HKU\S-1-5-21-2025429265-1972579041-725345543-1003\software\system process\ || lastptime (ID = 860390)
10:00 PM: HKU\S-1-5-21-2025429265-1972579041-725345543-1003\software\director\ || baseurl (ID = 980277)
10:00 PM: HKU\S-1-5-21-2025429265-1972579041-725345543-1003\software\microsoft\internet explorer\extensions\cmdmapping\ || {77fbf9b8-1d37-4ff2-9ced-192d8e3aba6f} (ID = 1021025)
10:00 PM: Registry Sweep Complete, Elapsed Time:00:01:21
10:00 PM: Starting Cookie Sweep
10:00 PM: Found Spy Cookie: websponsors cookie
10:00 PM: [email protected][2].txt (ID = 3665)
10:00 PM: Found Spy Cookie: yieldmanager cookie
10:00 PM: [email protected][2].txt (ID = 3751)
10:00 PM: Found Spy Cookie: hbmediapro cookie
10:00 PM: [email protected][2].txt (ID = 2768)
10:00 PM: Found Spy Cookie: addynamix cookie
10:00 PM: [email protected][1].txt (ID = 2062)
10:00 PM: Found Spy Cookie: atwola cookie
10:00 PM: owner@atwola[1].txt (ID = 2255)
10:00 PM: Found Spy Cookie: exitexchange cookie
10:00 PM: owner@exitexchange[1].txt (ID = 2633)
10:00 PM: Found Spy Cookie: 2o7.net cookie
10:00 PM: [email protected][1].txt (ID = 1958)
10:00 PM: Found Spy Cookie: questionmarket cookie
10:00 PM: owner@questionmarket[1].txt (ID = 3217)
10:00 PM: Found Spy Cookie: realmedia cookie
10:00 PM: owner@realmedia[2].txt (ID = 3235)
10:00 PM: Found Spy Cookie: rn11 cookie
10:00 PM: owner@rn11[2].txt (ID = 3261)
10:00 PM: Found Spy Cookie: trafficmp cookie
10:00 PM: owner@trafficmp[2].txt (ID = 3581)
10:00 PM: Found Spy Cookie: xiti cookie
10:00 PM: owner@xiti[1].txt (ID = 3717)
10:00 PM: Found Spy Cookie: adserver cookie
10:00 PM: [email protected][1].txt (ID = 2142)
10:00 PM: Found Spy Cookie: zedo cookie
10:00 PM: owner@zedo[1].txt (ID = 3762)
10:00 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01
10:00 PM: Starting File Sweep
10:01 PM: c:\windows\cfgmgr52 (33 subtraces) (ID = -2147479590)
10:04 PM: Found Adware: security iguard
10:04 PM: chmhelp.chm (ID = 75238)
10:04 PM: 89c8fd1e-b9c8-4bd7-8d2c-34aced (ID = 144946)
10:05 PM: Found Trojan Horse: trojan downloader matcash
10:05 PM: mc-110-12-0000137.exe (ID = 184140)
10:05 PM: autoit3.exe (ID = 185254)
10:05 PM: asappsrv.dll.q_105fde02_q (ID = 144945)
10:06 PM: freeprodtb.exe (ID = 198662)
10:08 PM: Found Adware: apropos
10:08 PM: wingenerics.dll (ID = 50187)
10:10 PM: File Sweep Complete, Elapsed Time: 00:10:07
10:10 PM: Full Sweep has completed. Elapsed time 00:16:10
10:10 PM: Traces Found: 378
10:13 PM: Removal process initiated
10:13 PM: Quarantining All Traces: adlogix
10:13 PM: Quarantining All Traces: cws_ns3
10:13 PM: Quarantining All Traces: directrevenue-abetterinternet
10:13 PM: Quarantining All Traces: trojan downloader matcash
10:13 PM: Quarantining All Traces: websearch toolbar
10:13 PM: Quarantining All Traces: apropos
10:13 PM: apropos is in use. It will be removed on reboot.
10:13 PM: wingenerics.dll is in use. It will be removed on reboot.
10:13 PM: Quarantining All Traces: coolwebsearch (cws)
10:13 PM: Quarantining All Traces: cws_tiny0
10:13 PM: Quarantining All Traces: delfin
10:13 PM: Quarantining All Traces: maxifiles
10:13 PM: Quarantining All Traces: trojan_downloader_tibser
10:13 PM: Quarantining All Traces: bookedspace
10:13 PM: Quarantining All Traces: command
10:13 PM: Quarantining All Traces: drsnsrch.com hijack
10:13 PM: Quarantining All Traces: security iguard
10:13 PM: Quarantining All Traces: systemprocess
10:13 PM: Quarantining All Traces: 2o7.net cookie
10:13 PM: Quarantining All Traces: addynamix cookie
10:13 PM: Quarantining All Traces: adserver cookie
10:13 PM: Quarantining All Traces: atwola cookie
10:13 PM: Quarantining All Traces: exitexchange cookie
10:13 PM: Quarantining All Traces: hbmediapro cookie
10:13 PM: Quarantining All Traces: questionmarket cookie
10:13 PM: Quarantining All Traces: realmedia cookie
10:13 PM: Quarantining All Traces: rn11 cookie
10:13 PM: Quarantining All Traces: trafficmp cookie
10:13 PM: Quarantining All Traces: websponsors cookie
10:13 PM: Quarantining All Traces: xiti cookie
10:13 PM: Quarantining All Traces: yieldmanager cookie
10:13 PM: Quarantining All Traces: zedo cookie
10:14 PM: Preparing to restart your computer. Please wait...
10:14 PM: Removal process completed. Elapsed time 00:00:42
********
9:54 PM: | Start of Session, Friday, January 06, 2006 |
9:54 PM: Spy Sweeper started
9:54 PM: Your spyware definitions have been updated.
9:54 PM: | End of Session, Friday, January 06, 2006 |


I didn't find that folder but Spy Sweeper found a lot of spyware. I left my computer on all night to check if i'd get anymore ads and I didn't!



So I think thats it.


Thank you for all your help, you guys rock! \m/