Infected file removal?

[Skywind]

Hmn i dont know if this is a virus or not but lately my computer is running a bit slow, every once in a while my AOL Security Center spots a A0049574.exe somewhere in System Volume Information, it says it cant block, clean, or delete it. Any ideas?

[jmoney3457]

sky, sys vol info is your system restore folder and NOTHING has access to that as in anti virus/spyware (etc) programs can't delete/modify anything in that folder...if you want, please post an hijackthis log and i'll look at it for you :)

[Skywind]

whats a hijackthis log?

[jmoney3457]

go HERE (http://www.short-media.com/forum/showpost.php?p=370235&postcount=1) and follow step 7 to post HJT log :)

[Skywind]

Hmn the link to download the HJTsetup.exe isnt working, tried googling it but their links fail to work too.

[jmoney3457]

try the setup from here http://www.bleepingcomputer.com/tutorials/tutorial94.html

[Skywind]

Logfile of HijackThis v1.99.1
Scan saved at 9:49:42 PM, on 12/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\AOL\1147030291\ee\SSCEvtHdlr.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Game\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.7.0\ViewBarBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\IEViewBar.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1147030291\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [Steam] "c:\game\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

[jmoney3457]

First download AVG anti-spyware from HERE (http://www.ewido.net/en/download/) and save that file to your desktop.
This is a 30 day trial of the program
Once you have downloaded AVG anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need run AVG and update the definition files.
On the main screen select the icon "Update" then select the "Update now" link.
Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.

Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Under "Reports"
Select "Automatically generate report after every scan"
Un-Select "Only if threats were found"

Close AVG anti-spyware, Do Not run a scan just yet, we will shortly.
Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or programs while AVG is scanning, it may interfere with the scanning proccess:
Lauch AVG-anti-spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
AVG will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close AVG and reboot your system back into Normal Mode and post the results of the AVG report scan.

[Skywind]

Does it matter if i already have antispyware software? aol security system = firewall, virus+spyware protection

[jmoney3457]

nope thats fine just follow my instructions from above post :)

[Skywind]

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 3:01:07 PM 1/3/2007

+ Scan result:



C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned.
C:\System Volume Information\_restore{12E3E37A-20ED-4D49-B7D6-3E086B2669A6}\RP173\A0047335.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned.
C:\software\kzmodbeta1.0_client\DotA Allstars v6.38b\d3dx9_25\cs_kloster\cs_bigwong\SPELL.FORCE.ORDER.OF.DAWN.V1.0.ENG.COBEMACHINE.NOCD.ZIP/Spellforce Patch Install.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned.
:mozilla.476:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.187:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.188:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.189:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.190:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.191:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.195:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.196:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.197:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.198:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.199:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.200:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.201:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.202:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.203:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.204:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.205:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.206:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.207:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.208:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.269:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.492:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134206.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134207.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134345.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134346.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134347.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134364.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134365.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134390.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134391.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134520.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134521.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134732.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134733.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134930.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134931.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134932.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134951.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00134952.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135380.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135401.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135402.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135863.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135864.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135926.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135927.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135928.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135929.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135930.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135931.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135932.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135933.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135934.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135935.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135936.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135937.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135938.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135939.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135940.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135941.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135942.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135943.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135944.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135945.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135946.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135947.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135948.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135949.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135950.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135951.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135952.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135953.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135954.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135955.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135956.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135957.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135958.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135962.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135963.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135964.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135965.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135966.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135967.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135968.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135969.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135971.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135972.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135973.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135974.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135975.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135976.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135977.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135978.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135979.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135980.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135981.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135982.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135983.TXT -> TrackingCookie.2o7 : Cleaned.
C:\RECYCLER\NPROTECT\00135984.TXT -> TrackingCookie.2o7 : Cleaned.
:mozilla.526:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.527:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.528:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.529:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.530:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.531:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.532:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.533:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.534:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.535:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.536:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.537:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.538:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.540:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@stats.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.23:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.24:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.456:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.457:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.458:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.459:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.460:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.493:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.494:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.168:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.170:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.171:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.172:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.173:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.60:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.224:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.596:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.468:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@citi.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.370:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.260:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.261:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.262:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@centrport[1].txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.161:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
:mozilla.350:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.497:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@cz7.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.79:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@techrepublic.com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ads.com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@com[1].txt -> TrackingCookie.Com : Cleaned.
:mozilla.354:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned.
:mozilla.441:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@****.com.19522.fb.dbbsrv[1].txt -> TrackingCookie.Dbbsrv : Cleaned.
:mozilla.62:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.579:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@as-eu.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@as1.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@sel.as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.153:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.154:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@media.fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@media.fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134300.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134301.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134302.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134303.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134304.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134607.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134608.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134609.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134610.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134611.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134760.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134761.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134766.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134767.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134768.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134769.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134770.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134775.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134776.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134777.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134778.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134779.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134791.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134792.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134793.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134794.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134795.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134798.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134799.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134800.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134801.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134802.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134805.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134806.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134807.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134808.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134809.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134810.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134827.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134828.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134829.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134830.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134831.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134834.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134835.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134836.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134837.TXT -> TrackingCookie.Fastclick : Cleaned.
C:\RECYCLER\NPROTECT\00134838.TXT -> TrackingCookie.Fastclick : Cleaned.
:mozilla.272:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@www.gamershell[1].txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@gator[1].txt -> TrackingCookie.Gator : Cleaned.
:mozilla.214:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.306:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.177:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.220:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.270:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.398:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.399:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.557:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ehg-aon.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ehg-ati.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ehg-guardian.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ehg-tigerdirect2.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ehg-warnerbrothers.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ehg-worldwildlifefund.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ehg-zoomerang.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@ehg-newegg.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.606:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned.
:mozilla.232:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.233:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@sales.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.403:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.157:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.158:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.566:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
:mozilla.508:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Ne : Cleaned.
:mozilla.443:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.444:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.445:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.151:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.152:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@paypopup[2].txt -> TrackingCookie.Paypopup : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.565:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Quarterserver : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned.
:mozilla.645:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Realtracker : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@web4.realtracker[1].txt -> TrackingCookie.Realtracker : Cleaned.
:mozilla.552:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.553:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@revenue[1].txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@revenue[2].txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.314:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.315:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.316:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.317:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.141:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.142:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.143:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.144:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.145:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.146:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\RECYCLER\NPROTECT\00134582.TXT -> TrackingCookie.Serving-sys : Cleaned.
C:\RECYCLER\NPROTECT\00134763.TXT -> TrackingCookie.Serving-sys : Cleaned.
C:\RECYCLER\NPROTECT\00134771.TXT -> TrackingCookie.Serving-sys : Cleaned.
C:\RECYCLER\NPROTECT\00134780.TXT -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.407:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.408:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.409:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.410:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.411:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.412:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.413:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.414:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.415:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.416:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.392:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.393:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.394:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.395:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.396:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@starware[2].txt -> TrackingCookie.Starware : Cleaned.
:mozilla.25:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.26:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.27:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.28:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.29:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.30:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.31:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.32:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.33:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.34:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.35:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.36:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.37:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.38:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.39:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.40:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.41:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.42:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.43:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.44:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.45:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.46:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.47:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.48:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.499:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@targetnet[2].txt -> TrackingCookie.Targetnet : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.371:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@trafic[1].txt -> TrackingCookie.Trafic : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@trafic[1].txt -> TrackingCookie.Trafic : Cleaned.
:mozilla.61:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Guest\Cookies\guest@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\daniel\Cookies\daniel@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.287:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.294:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.295:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.296:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.65:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.66:C:\Documents and Settings\daniel\Application Data\Mozilla\Firefox\Profiles\iy4n5xhp.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@c1.zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\daniel\Desktop\skywind\Cookies\skywind@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@c1.zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\sjin\Cookies\sjin@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.


::Report end

[jmoney3457]

please post new HJT

[Skywind]

Logfile of HijackThis v1.99.1
Scan saved at 3:04:39 PM, on 1/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\game\steam\steam.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\AOL\1147030291\ee\SSCEvtHdlr.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Game\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.7.0\ViewBarBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\IEViewBar.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1147030291\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Steam] "c:\game\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

[jmoney3457]

go here (http://www.short-media.com/forum/showthread.php?t=43902) follow step 3 and perform the kaspersky scan and post results back here

[Skywind]

KASPERSKY ONLINE SCANNER REPORT
Sunday, January 07, 2007 10:25:54 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 7/01/2007
Kaspersky Anti-Virus database records: 256608
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\
Scan Statistics
Total number of scanned objects 96044
Number of viruses found 0
Number of infected objects 0 / 0
Number of suspicious objects 0
Duration of the scan process 01:34:04

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c3977c3c625f99bd04d2017de2ec34af_10064d12-e58a-4b2e-9355-2e0545c7fb29 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cb43b77fae4f5688ed3a96669f6a76d6_10064d12-e58a-4b2e-9355-2e0545c7fb29 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fec49a012340ce71fb306e6165d59d4a_10064d12-e58a-4b2e-9355-2e0545c7fb29 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\mcafee.com personal firewall\data\IpRules.xdb Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\49afb5479232290aaed43eef5cf41316_51d29bf8-bd5c-4f6d-b5e3-3eafcb0e56f3 Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\76a3e5ba491698d6be5257578a82be34_51d29bf8-bd5c-4f6d-b5e3-3eafcb0e56f3 Object is locked skipped
C:\Documents and Settings\daniel\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Application Data\AOL OCP\AIM\Storage\data\Skywind555\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\History\History.IE5\MSHist012007010720070108\index.dat Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Temp\sqlite_svVFrOmsazqzTpV Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Temp\sqlite_wPo27vRdnfuaRQc Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Temp\sqlite_X0T85oLixreWpdv Object is locked skipped
C:\Documents and Settings\daniel\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\daniel\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\daniel\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\daniel\UserData\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Program Files\CA\PPRT\logs\2007-01-06.csv Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{12E3E37A-20ED-4D49-B7D6-3E086B2669A6}\RP186\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\deadjowood.exe Object is locked skipped
Scan process completed.

[jmoney3457]

nothing showing in that log..how is the computer now?

[Skywind]

its still the same =/

[jmoney3457]

how exactly is it behaving? pop ups? slow internet? etc..

[Skywind]

well i load things a lot slower, and big lag spikes here and there

[jmoney3457]

could be something with your ISP, have you tried contacting them?

[Skywind]

probably not, i think its just this computer being slow and usually ISP problems last only a few days, this has been at least two weeks

[jmoney3457]

go HERE (http://www.speakeasy.net/speedtest/), choose location nearest you and let me know the DL/UL speeds

[Skywind]

Downloading - 4482 kbps
Uploading - 475 kbps

[jmoney3457]

fast, you shouldn't be having much (if any) problems with those speeds please post new HJT

[Skywind]

Logfile of HijackThis v1.99.1
Scan saved at 7:31:01 PM, on 1/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\AOL\1147030291\ee\SSCEvtHdlr.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\World of Warcraft\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Game\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.7.0\ViewBarBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\IEViewBar.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1147030291\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Steam] "c:\game\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

[jmoney3457]

a couple of things 1)do/did you have a brother printer? 2)open hijack this click on do a system scan only and place a check next to this line:O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u then make sure ALL windows except hjt are closed then hit fix checked reboot and post new log

[Skywind]

yes i think i have the brother printer


Logfile of HijackThis v1.99.1
Scan saved at 12:46:30 AM, on 1/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\game\steam\steam.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\SSCEvtHdlr.exe
C:\Program Files\Common Files\AOL\1147030291\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\software\utorrent.exe
C:\Game\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.7.0\ViewBarBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\IEViewBar.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1147030291\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Steam] "c:\game\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

[jmoney3457]

please go to C:\Game\HijackThis.exe then rename hijackthis.exe
to scanner.exe then perform new HJT scan and post new log..this is due to new spyware can detect hijackthis.exe on your system and hide itself

[Skywind]

Logfile of HijackThis v1.99.1
Scan saved at 11:11:46 PM, on 1/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\game\steam\steam.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\SSCEvtHdlr.exe
C:\Program Files\Common Files\AOL\1147030291\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Game\scanner.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.7.0\ViewBarBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.7.0\IEViewBar.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1147030291\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Steam] "c:\game\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

[jmoney3457]

log's clean, any problems?

[Skywind]

yeah i still have a problem with ping, oh and when i restart or shut down my computer, it says that the program isnt responding and the program is called "Hidden Window" and i have no idea what that is

[jmoney3457]

Please download/run this tool->http://www.xblock.com/download/xclean_micro.exe it will scan for spyware alphanumerically and if/when it detects something a prompt box will come up asking you to remove or ignore choose remove but some of the items it detects maybe programs you intentionally installed such as an arcade game if this is the case simply press ignore then once the scan is done it will NOT produce a log so don't worry about posting one just try and note some of the things it removes and list them in your next reply (if possible) and reboot when it asks you to and also return with a fresh HJT log

[Skywind]

Logfile of HijackThis v1.99.1
Scan saved at 9:58:23 PM, on 1/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\game\steam\steam.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\SSCEvtHdlr.exe
C:\Program Files\Common Files\AOL\1147030291\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Game\scanner.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1147030291\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Steam] "c:\game\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

uh i think some of the things was:

weatherbug
viewpoint
gamespybot arcade

also the hidden window closing during shutdown/restart isnt there but theres still one called rGaskdhuhasjfnjknfdsiter-defa.... one(i dont know exact spelling but its all gibberish)

[jmoney3457]

fix this line in HJT then reboot post new log:O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab

[Skywind]

whats that link for? and btw the hidden window thing is still there for some reason during shutdown

[jmoney3457]

the link is part of the HJT line I want you to fix..please do so reboot post new log, as for that window, I'm not sure, could you please take a screen shot of it and attach it to your next reply

[Skywind]

er how would i screen shot if i was turning/restarting my computer off?

[Skywind]

Logfile of HijackThis v1.99.1
Scan saved at 9:59:41 PM, on 1/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\AOL\1147030291\ee\SSCEvtHdlr.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Game\scanner.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147030291\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1147030291\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Steam] "c:\game\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1147030291\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)



uh after i reseted my computer after i fixted the HJT line, my internet is loading REALLY REALLY slow. like 30 seconds to load google and 10 minutes to load the second page of this topic to the point where i can click new reply. the hidden window thing doesnt seem to be there any more either, ill screenshot or try to if i see it

[jmoney3457]

er how would i screen shot if i was turning/restarting my computer off?
good point:D, 1. Please Download and install Superantispyware
http://www.superantispyware.com/down...NTISPYWAREFREE
Load Superantispyware and click the check for updates button.
Once the update is finished, close SuperAntispyware again, we'll perform the scan later in safe mode

* Start Superantispyware.
Click the scan your computer button.
Check Perform Complete Scan and then next.
Superantispyware will now scan your computer and when its finished it will list all the infections it has found.
Make sure that they all have a check next to them and press next.
Click finish and you will be taken back to the main interface.
Click Preferences and then click the statistics/logs tab. Click the dated log and press view log and a text file will appear post that log in your next reply


2. Also download this file - combofix.exe
http://download.bleepingcomputer.com/sUBs/combofix.exe
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
please return with the super AS & combo logs