help with AIM virus please :)

beanz06beanz06
edited October 2005 in Spyware & Virus Removal
Hi, I clicked on a link that said "don't i look cute?" or something like that... and I think I have a virus that is preventing my internet from working. I would greatly appreciate help with this problem, thank you in advance :) also, do i need to back up anything before i go about trying to resolve the issue? here is my Hijack This log:

Logfile of HijackThis v1.99.1
Scan saved at 10:05:31 PM, on 10/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
C:\Program Files\Avast4\ashServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\msdpy.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [PSPVideo9] C:\Program Files\pspvideo9\pspVideo9.exe -t
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Manager Host Service] mrhsvc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcPro7_0_3
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.kontiki.com/kdx/Client403/kdx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Microsoft Display (MSDPY) - Unknown owner - C:\WINDOWS\msdpy.exe

Comments

  • beanz06beanz06
    edited October 2005
    by the way the exact link i clicked on was:

    hxxp://www.75thid.com/cache/01-picture.cxm [ive placed x's so that nobody accidently clicks this, please be careful!]

    ive also already run spybot, ad-aware, and microsoft antispyware multiple times on my comp. thanks again for any help you could offer :):)
  • beanz06beanz06
    edited October 2005
    can someone please help me soon? i am applying to medical schools and cannot properly do so without being able to access the internet from my infected computer, which has all my application information.... so i would truly appreciate some assistance as soon as possible, as my entire future career is at stake!! :p thank you again :)
  • TroganTrogan London, UK
    edited October 2005
    Hi,

    sorry about the delay. Can you post a new HJT log please :)
  • beanz06beanz06
    edited October 2005
    thank you so much for your help!!! here it is:

    Logfile of HijackThis v1.99.1
    Scan saved at 12:01:11 PM, on 10/20/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    C:\PROGRA~1\Avast4\ashDisp.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\PROGRA~1\Webshots\webshots.scr
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\Program Files\Avast4\aswUpdSv.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
    C:\Program Files\Avast4\ashServ.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\WINDOWS\msdpy.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Avast4\ashMaiSv.exe
    C:\Program Files\Avast4\ashWebSv.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [PSPVideo9] C:\Program Files\pspvideo9\pspVideo9.exe -t
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\RunServices: [Manager Host Service] mrhsvc.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcPro7_0_3
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
    O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.kontiki.com/kdx/Client403/kdx.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Microsoft Display (MSDPY) - Unknown owner - C:\WINDOWS\msdpy.exe



    do i need to back up anything before i try to resolve the problem?
  • TroganTrogan London, UK
    edited October 2005
    No need to backup anything accept your medical work!
    ===

    Check the following in HJT and click 'Fix Checked'

    O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O4 - HKLM\..\RunServices: [Manager Host Service] mrhsvc.exe
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
    ===

    Can you go here and type the following in the box provided. Then click Submit and the file will be scanned by various Anti-Viruses. Post the results here.

    C:\WINDOWS\msdpy.exe
    ===

    Scan your PC with the following:

    Panda Activescan

    There maybe files that cannot be removed. Post them here.
    ===

    Post a new HJT log :)
  • beanz06beanz06
    edited October 2005
    hi! problem - i can't connect to the internet on that computer. i am currently using a different comp. so i did the first part of what you said, can't do the second part, and am now trying to download panda antivirus to transfer onto the infected comp and scan.... new HJT log to come soon as i'm done....
  • TroganTrogan London, UK
    edited October 2005
    Download the Winsock Fix XP and transfer it to the problem computer. Close all windows and run the tool. Hopefully, you should have the internet back :)
  • beanz06beanz06
    edited October 2005
    okay i ran the Winsock Fix XP tool, and unfortunately my college campus is being ridiculous and now THEY are not letting me access the internet. something about detecting suspicious IRC action or something along those lines. so i will have to wait and try this when i go home tomorrow evening! :( thanks though, i guess i will talk to you tomorrow :)

    i ran another HJT log just in case:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:01:00 PM, on 10/20/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    C:\Program Files\pspvideo9\pspVideo9.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    C:\PROGRA~1\Avast4\ashDisp.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\PROGRA~1\Webshots\webshots.scr
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\Program Files\Avast4\aswUpdSv.exe
    C:\Program Files\Avast4\ashServ.exe
    C:\WINDOWS\msdpy.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Avast4\ashMaiSv.exe
    C:\Program Files\Avast4\ashWebSv.exe
    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [PSPVideo9] C:\Program Files\pspvideo9\pspVideo9.exe -t
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcPro7_0_3
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
    O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.kontiki.com/kdx/Client403/kdx.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Microsoft Display (MSDPY) - Unknown owner - C:\WINDOWS\msdpy.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
  • beanz06beanz06
    edited October 2005
    okay here are the results:

    results1cc.png




    and i did the panda activescan of "My Computer," here are the results:


    Incident Status Location

    Adware:adware/exact.searchbar No disinfected C:\Documents and Settings\Sabina\Local Settings\Temp\blank.gif
    Adware:Adware/IST.ISTBar No disinfected C:\Documents and Settings\Sabina\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3c936701-356c671e.zip[InstallerApplet.class]
    Adware:Adware/IST.ISTBar No disinfected C:\Documents and Settings\Sabina\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3cc46f89-3c0c85d0.zip[InstallerApplet.class]
    Adware:Adware/IST.ISTBar No disinfected C:\Documents and Settings\Sabina\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-4dd4eacc.zip[InstallerApplet.class]
    Adware:Adware/IST.ISTBar No disinfected C:\Documents and Settings\Sabina\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5ad1bcbe-509b7b7b.zip[InstallerApplet.class]

    and finally, here is my new HJT log:




    Logfile of HijackThis v1.99.1
    Scan saved at 7:41:28 PM, on 10/21/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    C:\Program Files\pspvideo9\pspVideo9.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    C:\PROGRA~1\Avast4\ashDisp.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\PROGRA~1\Webshots\webshots.scr
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\Program Files\Avast4\aswUpdSv.exe
    C:\Program Files\Avast4\ashServ.exe
    C:\WINDOWS\msdpy.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\plugins\GetFlash.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [PSPVideo9] C:\Program Files\pspvideo9\pspVideo9.exe -t
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcPro7_0_3
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
    O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.kontiki.com/kdx/Client403/kdx.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Microsoft Display (MSDPY) - Unknown owner - C:\WINDOWS\msdpy.exe



    thanks so much for your help! :):):)
  • TroganTrogan London, UK
    edited October 2005
    Download CWShredder 2.15 from here. Check for updates first and then Run it and press the *fix,* not scan and allow it to clean the infection. Close all browser and explorer windows before hitting the fix button.
    ===

    Disable System Restore - explained here

    View hidden files and folders - explained here

    Go into Safe Mode - explained here
    ===

    Find and Delete the highlighted file:

    C:\WINDOWS\msdpy.exe
    ===

    Run CWShredder again in Safe Mode
    ===

    Reboot into Normal Mode and enable System Restore (same link as disbaling). Post a new HJT log :)
  • beanz06beanz06
    edited October 2005
    hi! i hit "fix" in the CWShredder, and it says "Scan is complete! CoolWebSearch was not found on this system." basically it seems it didn't find anything infected.... should i proceed to the next steps you gave me?
  • TroganTrogan London, UK
    edited October 2005
    Yep :)
  • beanz06beanz06
    edited October 2005
    done! here you go :)

    Logfile of HijackThis v1.99.1
    Scan saved at 10:32:58 PM, on 10/21/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    C:\Program Files\pspvideo9\pspVideo9.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    C:\PROGRA~1\Avast4\ashDisp.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
    C:\Program Files\Common Files\AOL\1127774923\ee\AOLServiceHost.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
    C:\Program Files\Avast4\aswUpdSv.exe
    C:\Program Files\Avast4\ashServ.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Avast4\ashMaiSv.exe
    C:\Program Files\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [PSPVideo9] C:\Program Files\pspvideo9\pspVideo9.exe -t
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1127774923\ee\AOLHostManager.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcPro7_0_3
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
    O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.kontiki.com/kdx/Client403/kdx.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Microsoft Display (MSDPY) - Unknown owner - C:\WINDOWS\msdpy.exe (file missing)
  • TroganTrogan London, UK
    edited October 2005
    Download Ewido Security Suite
    • Install ewido security suite
    • When installing, under "Additional Options" uncheck..
      • Install background guard
      • Install scan via context menu
    • Launch ewido, there should be an icon on your desktop, double-click it.
    • You will need to update ewido to the latest definition files.
      • On the left hand side of the main screen click update.
      • Then click on Start Update.
    • The update will start and a progress bar will show the updates being installed.
      (the status bar at the bottom will display "Update successful")
    • Now, scan with it by clicking 'Scanner' on the left and choosing 'Complete System Scan'

    Save a log and post it here
    ===

    Is your internet working?
  • beanz06beanz06
    edited October 2005
    yup, internet is working now! here is the log:
    ewido security suite - Scan report

    + Created on: 11:54:57 PM, 10/21/2005
    + Report-Checksum: 508F1E53

    + Scan result:

    HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
    HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
    HKU\S-1-5-21-960141890-1667729427-2187485722-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{36A59337-6EEF-40AE-94B1-ED443A0C4740} -> Spyware.BetterInternet : Cleaned with backup
    HKU\S-1-5-21-960141890-1667729427-2187485722-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{556DDE35-E955-11D0-A707-000000521958} -> Spyware.IEPlugin : Cleaned with backup
    HKU\S-1-5-21-960141890-1667729427-2187485722-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DDFFA75A-E81D-4454-89FC-B9FD0631E726} -> Spyware.VX2 : Cleaned with backup
    :mozilla.9:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.10:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
    :mozilla.11:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
    :mozilla.12:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.13:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.14:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.15:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.16:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.17:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.18:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.19:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.20:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.21:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.22:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.23:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.24:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.25:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.26:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.27:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.28:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.29:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.30:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.31:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.32:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.33:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.34:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.35:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.36:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.37:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.38:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.39:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.40:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.41:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.42:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.43:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.44:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.45:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.46:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.47:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.48:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.62:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adbrite : Cleaned with backup
    :mozilla.69:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
    :mozilla.70:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
    :mozilla.78:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
    :mozilla.79:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
    :mozilla.80:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
    :mozilla.81:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
    :mozilla.82:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
    :mozilla.83:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.84:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.97:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.98:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.99:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.100:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.107:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.108:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.109:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.110:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.111:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.163:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    :mozilla.164:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    :mozilla.173:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.174:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.175:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.176:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.177:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.180:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
    :mozilla.181:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
    :mozilla.182:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
    :mozilla.187:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
    :mozilla.188:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
    :mozilla.189:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
    :mozilla.190:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
    :mozilla.204:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.205:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.206:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.207:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.208:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.209:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.219:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.337:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
    :mozilla.338:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
    :mozilla.346:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
    :mozilla.357:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
    :mozilla.375:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.376:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.377:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.378:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.379:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.380:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.381:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.382:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.383:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.402:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
    :mozilla.403:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
    :mozilla.404:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
    :mozilla.405:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
    :mozilla.406:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
    :mozilla.414:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Spylog : Cleaned with backup
    :mozilla.417:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.418:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.419:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.420:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.421:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.422:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.423:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.424:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.425:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.426:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.427:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.428:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.453:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.454:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.455:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.456:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
    :mozilla.457:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
    :mozilla.458:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
    :mozilla.459:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
    :mozilla.460:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
    :mozilla.461:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
    :mozilla.468:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.469:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.470:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.471:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.472:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.473:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.502:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Weborama : Cleaned with backup
    :mozilla.534:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.535:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.536:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.537:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.540:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.541:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.542:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.543:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.544:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.545:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.546:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.564:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.565:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.566:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.567:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.568:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.569:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.585:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
    :mozilla.586:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
    :mozilla.587:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
    :mozilla.640:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
    :mozilla.641:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
    :mozilla.675:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
    :mozilla.676:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    :mozilla.701:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
    :mozilla.702:C:\Documents and Settings\Sabina\Application Data\Mozilla\Firefox\Profiles\llj7ub29.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
    C:\Documents and Settings\Sabina\Cookies\sabina@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\Sabina\Cookies\sabina@ad1.clickhype[1].txt -> Spyware.Cookie.Clickhype : Cleaned with backup
    C:\Documents and Settings\Sabina\Cookies\sabina@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
    C:\Documents and Settings\Sabina\Cookies\sabina@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    C:\Documents and Settings\Sabina\Cookies\sabina@com[1].txt -> Spyware.Cookie.Com : Cleaned with backup
    C:\Documents and Settings\Sabina\Cookies\sabina@www.burstbeacon[1].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
    C:\Documents and Settings\Sabina\Cookies\sabina@www.burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    C:\Documents and Settings\Sabina\Cookies\sabina@www.myaffiliateprogram[1].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    C:\WINDOWS\system32\mrhsvc.exe -> Backdoor.IRCBot : Cleaned with backup


    ::Report End
  • TroganTrogan London, UK
    edited October 2005
    Everything looks good :thumbsup:

    Are you still having problems?


    Did the Winsock Tool help fix your connection or was it something else?
Sign In or Register to comment.