Here are the requested logs as follows:
New hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 15:38:22, on 02/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\essspk.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HPONE-~1\OneTouch.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\BTBROA~1\Help\SMARTB~1\BTHelpNotifier.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\Hummbird\inetd32.exe
C:\WINDOWS\System32\HPConfig.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\WINDOWS\system32\RadioSvr.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BT Broadband 205\Help\bin\mpbtn.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://dial.blueyonder.co.uk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CP4HPOT] C:\PROGRA~1\HPONE-~1\OneTouch.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Presentation Ready] C:\Program Files\Hewlett-Packard\HP Presentation Ready\PresRdy.exe -r
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus C70 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C70 Series" /O5 "LPT1:" /M "Stylus C70"
O4 - HKLM\..\Run: [EPSON Stylus C70 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P32 "EPSON Stylus C70 Series (Copy 1)" /O6 "USB002" /M "Stylus C70"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTBROA~1\Help\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Broadband Desktop Help.lnk = C:\Program Files\BT Broadband 205\Help\bin\matcli.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://dial.blueyonder.co.uk
O15 - Trusted Zone:
http://*.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?link...67&clcid=0x409
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) -
http://216.249.24.141/code/PWActiveXImgCtl.CAB
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {84818113-96C5-11D2-BE39-006008BF4DD5} (ViewDirector Object) -
http://www.scotlandspeople.gov.uk/Vi...l/viewdw32.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {9FC87BC7-7963-4B70-8485-B1A41034C9A1} (CSonyPicturesGameDownloaderCtl Object) -
http://www.shockwave.com/content/ang...Downloader.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: HCLInetd - Hummingbird Communications Ltd. - C:\WINDOWS\system32\Hummbird\inetd32.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\System32\HPConfig.exe
O23 - Service: HP RF Device Service (HpRfDev) - Hewlett-Packard - C:\WINDOWS\system32\HpRfDev.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: RadioSvr - Hewlett-Packard - C:\WINDOWS\system32\RadioSvr.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
*****************************************************
Kaspersky Online Scan log:
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, March 02, 2006 3:26:21 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 2/03/2006
Kaspersky Anti-Virus database records: 179622
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
Scan Statistics:
Total number of scanned objects: 68901
Number of viruses found: 16
Number of infected objects: 96
Number of suspicious objects: 0
Duration of the scan process: 02:32:17
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Owner\.housecall\Quarantine\1Click DVD Copy Pro 1.0.0.6.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\a.tmp.bac_a03920 Infected: Email-Worm.Win32.VB.an skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\a.zip.bac_a03920/Setup.exe Infected: Email-Worm.Win32.VB.an skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\a.zip.bac_a03920 ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\a.zip.bac_a03920 CryptFF.b: infected - 1 skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\A0150081.dll.bac_a03920 Infected: not-a-virus:AdWare.Win32.180Solutions.a skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\A0150163.exe.bac_a03920 Infected: not-a-virus:AdWare.Win32.180Solutions.ae skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\A0150165.exe.bac_a03920 Infected: not-a-virus:AdWare.Win32.180Solutions.ac skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\A0150166.dll.bac_a03920 Infected: not-a-virus:AdWare.Win32.Agent.c skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\A0150252.dll.bac_a03920 Infected: not-a-virus:AdWare.Win32.180Solutions.a skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\A0150562.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\A0150572.exe.bac_a03920 Infected: Email-Worm.Win32.VB.an skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\A0150573.exe.bac_a03920 Infected: Email-Worm.Win32.VB.an skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\AceHTML Pro v6.05.8.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Advanced system optimizer v2.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\AVG Anti-Virus v7.1.362.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\BricsCad Pro v6.2.0010.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Cat5Data v1.0.9.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\DLL Designer v2.3.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Error Doctor 2006 1.2.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Error Doctor 2006 v1.2.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\FlashChat v4.4.2.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Focus On VBS v1.6.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\GCode2000 v28.09.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\GoldWave 5.11.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Google Desktop 2.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Hide IP Platinum v2.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\IncrediMail XE 4.50.2131 Beta.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Lavasoft Personal Firewall v1.0.543.5722.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Link Commander 2.5.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Magic Translator v5.00.5290.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\MediaGateway.exe.bac_a03920 Infected: not-a-virus:AdWare.Win32.WinAD.bv skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Moho v5.21.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Planet Pluto 3D Screensaver.v1.1.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Planet Uranus 3D Screensaver.v1.1.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Privacy Shredder 3.1.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Pure CD Ripper 3.3.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Sibelius v4.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Sothink SWF Quicker 1.6 Build 50428.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\SoundCoder 1.0.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\SpyRemover v2.45.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Startup Faster! 2004 V 2.4.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\StudyProf Flash Cards v1.10.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\svchost.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Tracks Eraser v4.10.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Ultra MPEG Converter v1.9.2.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\VectorChat 1.0.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Vista Transformation Pack 2.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Web Page Maker 2.03 38.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\WINner Tweak v3.3.2.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\winupdates.exe.bac_a03920 Infected: Email-Worm.Win32.VB.an skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\XP Repair Pro v2.4.1.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\XPFit v1.1.1.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\xzxzxzxzxzxz.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Zam BeeZee v0.95.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Zealot All Video Joiner v1.9.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Zealot All Video Splitter v2.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\.housecall\Quarantine\Zend Studio Client v5.0.exe.bac_a03920 Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\Documents and Settings\Owner\a.exe Infected: Trojan-Downloader.Win32.VB.xr skipped
C:\Program Files\Microsoft AntiSpyware\Quarantine\02F51E25-FD7B-442A-BCF1-1BA53D\F9506D82-938E-4BB2-B641-3D7F9C Infected: not-a-virus:AdWare.Win32.MyWay.w skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2D.tmp Infected: Backdoor.Win32.Rbot.gen skipped
C:\RECYCLER\S-1-5-21-2389969595-672976513-239712180-1003\Dc10.exe Infected: Trojan-Downloader.Win32.Adload.u skipped
C:\RECYCLER\S-1-5-21-2389969595-672976513-239712180-1003\Dc11.exe/data0002 Infected: Trojan-Clicker.Win32.Small.jf skipped
C:\RECYCLER\S-1-5-21-2389969595-672976513-239712180-1003\Dc11.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152833.exe Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152834.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152835.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152836.exe/InpB/SskBho.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152836.exe/InpB/SskCore.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152836.exe/InpB/Ssk.exe Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152836.exe/InpB/Ssk3RepairInstall.exe Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152836.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152836.exe CAB: infected - 5 skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152860.exe/data0002 Infected: Trojan-Clicker.Win32.Small.jf skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152860.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152862.exe Infected: Trojan-Downloader.Win32.Adload.u skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152969.exe Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152970.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152971.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153277.exe/InpB/SskBho.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153277.exe/InpB/SskCore.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153277.exe/InpB/Ssk.exe Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153277.exe/InpB/Ssk3RepairInstall.exe Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153277.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153277.exe CAB: infected - 5 skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153311.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153312.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153313.exe Infected: not-a-virus:AdWare.Win32.SurfSide.aa skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153343.exe Infected: Trojan-Downloader.Win32.VB.xr skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153423.exe Infected: Trojan-Downloader.Win32.VB.xr skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153432.exe Infected: Trojan-Downloader.Win32.VB.xr skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153459.exe Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153460.exe Infected: Trojan.Win32.StartPage.aib skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153461.exe Infected: Trojan-Downloader.Win32.Adload.v skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153462.exe Infected: Backdoor.Win32.Rbot.gen skipped
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153463.exe Infected: Trojan-Clicker.Win32.VB.li skipped
Scan process completed.
*****************************************************
Ewido log:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 12:05:43, 02/03/2006
+ Report-Checksum: E486514F
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7} -> Adware.Generic : Cleaned with backup
HKLM\SOFTWARE\SurfSideKick3 -> Adware.SurfSide : Cleaned with backup
HKLM\SOFTWARE\SurfSideKick3\Internet Explorer -> Adware.SurfSide : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.12:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\8h85s0td.default\cookies.txt -> TrackingCookie.Adviva : Cleaned with backup
C:\hijackthis\backups\backup-20060302-082635-768-svchost.exe -> Dropper.VB.lu : Cleaned with backup
C:\RECYCLER\S-1-5-21-2389969595-672976513-239712180-1003\Dc4.exe -> Hijacker.StartPage.aib : Cleaned with backup
C:\RECYCLER\S-1-5-21-2389969595-672976513-239712180-1003\Dc9.exe -> Downloader.Adload.v : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150551.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150585.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150598.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150608.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150609.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150610.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150611.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150612.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150613.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150614.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150615.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150616.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150617.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150618.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150619.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150620.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150621.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150622.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150623.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150624.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150625.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150626.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150627.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150628.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150629.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150630.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150631.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150632.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150633.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150634.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150635.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150636.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150637.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150638.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150639.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150640.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150641.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150642.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150643.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150644.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150645.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150646.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150647.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150648.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150649.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150650.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0150666.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP396\A0152689.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152719.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152843.exe -> Downloader.Adload.v : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152844.exe -> Hijacker.VB.li : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152861.exe -> Hijacker.StartPage.aib : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152863.exe -> Downloader.Adload.t : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152924.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0152977.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153293.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153300.dll -> Hijacker.Small.jf : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153307.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153327.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153339.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153344.exe -> Downloader.Adload.t : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153346.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153347.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153419.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153430.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153441.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153446.exe -> Dropper.VB.lu : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153448.exe -> Backdoor.Rbot : Cleaned with backup
C:\System Volume Information\_restore{BE7F1F4B-F208-4467-BA00-4314DC91E883}\RP397\A0153458.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup
C:\WINDOWS\b.exe -> Backdoor.Rbot : Cleaned with backup
C:\winsysban12.exe -> Hijacker.VB.li : Cleaned with backup
::Report End
*****************************************************
WinPfind log:
WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.
If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.
»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180
»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»
Checking %SystemDrive% folder...
UPX! 11/02/2003 18:32:30 73216 C:\holistyc.exe
Checking %ProgramFilesDir% folder...
Checking %WinDir% folder...
Checking %System% folder...
UPX! 27/01/2006 22:38:10 503296 C:\WINDOWS\SYSTEM32\aswBoot.exe
UPX! 17/09/2001 12:20:02 9216 C:\WINDOWS\SYSTEM32\cpuinf32.dll
PEC2 18/08/2001 05:00:00 41397 C:\WINDOWS\SYSTEM32\dfrg.msc
UPX! 13/08/2003 15:43:54 325341 C:\WINDOWS\SYSTEM32\h5.exe
UPX! 31/10/2001 10:14:40 30720 C:\WINDOWS\SYSTEM32\mplaa6.dll
UPX! 31/10/2001 10:14:40 30208 C:\WINDOWS\SYSTEM32\mplam6.dll
UPX! 31/10/2001 10:14:40 29184 C:\WINDOWS\SYSTEM32\mplapx.dll
UPX! 31/10/2001 10:14:40 30720 C:\WINDOWS\SYSTEM32\mplaw7.dll
UPX! 31/10/2001 10:14:40 215040 C:\WINDOWS\SYSTEM32\mplva6.dll
UPX! 31/10/2001 10:14:40 203264 C:\WINDOWS\SYSTEM32\mplvm6.dll
UPX! 31/10/2001 10:14:40 245760 C:\WINDOWS\SYSTEM32\mplvpx.dll
UPX! 31/10/2001 10:14:40 211456 C:\WINDOWS\SYSTEM32\mplvw7.dll
PECompact2 08/02/2006 05:23:40 4513120 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 08/02/2006 05:23:40 4513120 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 04/08/2004 07:56:36 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
PEC2 16/11/1996 23:00:00 163384 C:\WINDOWS\SYSTEM32\ODBCJET.HLP
Umonitor 04/08/2004 07:56:44 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 18/08/2001 05:00:00 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu
Checking %System%\Drivers folder and sub-folders...
PTech 04/08/2004 05:41:38 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys
Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts
qoologic 01/03/2006 11:55:34 1558 C:\WINDOWS\SYSTEM32\drivers\etc\hosts.bak
urllogic 01/03/2006 11:55:34 1558 C:\WINDOWS\SYSTEM32\drivers\etc\hosts.bak
Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
02/03/2006 08:34:40 S 2048 C:\WINDOWS\bootstat.dat
02/03/2006 08:09:04 H 23716 C:\WINDOWS\system32\FFASTLOG.TXT
03/01/2006 13:17:06 S 8792 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB911564.cat
13/01/2006 12:34:32 S 7898 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB911565.cat
04/01/2006 05:39:38 S 11223 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB911927.cat
02/01/2006 23:09:36 S 11223 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB912919.cat
13/01/2006 19:28:32 S 10925 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB913446.cat
02/03/2006 08:34:22 H 8192 C:\WINDOWS\system32\config\default.LOG
02/03/2006 08:35:52 H 1024 C:\WINDOWS\system32\config\SAM.LOG
02/03/2006 08:34:44 H 16384 C:\WINDOWS\system32\config\SECURITY.LOG
02/03/2006 12:04:52 H 212992 C:\WINDOWS\system32\config\software.LOG
02/03/2006 08:49:22 H 966656 C:\WINDOWS\system32\config\system.LOG
16/02/2006 11:34:52 H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG
11/01/2006 11:58:24 S 1047 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\7C8A03C4580C6B04FDF34357F3474EDC
11/01/2006 11:58:24 S 1370 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\B82262A5D5DA4DDACE9EDA7F787D0DEB
11/01/2006 11:58:24 S 126 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\7C8A03C4580C6B04FDF34357F3474EDC
11/01/2006 11:58:24 S 194 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\B82262A5D5DA4DDACE9EDA7F787D0DEB
19/01/2006 18:47:18 HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\e13e86d3-27d3-4a90-88b3-a271809908aa
19/01/2006 18:47:18 HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
02/03/2006 08:33:36 H 6 C:\WINDOWS\Tasks\SA.DAT
Checking for CPL files...
02/04/2003 23:17:40 172032 C:\WINDOWS\SYSTEM32\ac3filter.cpl
Microsoft Corporation 04/08/2004 07:56:58 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 04/08/2004 07:56:58 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Microsoft Corporation 04/08/2004 07:56:58 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Microsoft Corporation 04/08/2004 07:56:58 135168 C:\WINDOWS\SYSTEM32\desk.cpl
16/11/1996 23:00:00 22528 C:\WINDOWS\SYSTEM32\FINDFAST.CPL
Microsoft Corporation 04/08/2004 07:56:58 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 04/08/2004 07:56:58 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Microsoft Corporation 04/08/2004 07:56:58 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Hummingbird Communications Ltd.26/08/1996 13:48:56 13312 C:\WINDOWS\SYSTEM32\inetd32.cpl
Microsoft Corporation 04/08/2004 07:56:58 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 04/08/2004 07:56:58 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 04/08/2004 07:56:58 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems, Inc. 10/11/2005 13:03:50 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 18/08/2001 05:00:00 187904 C:\WINDOWS\SYSTEM32\main.cpl
Microsoft Corporation 04/08/2004 07:56:58 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 18/08/2001 05:00:00 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
Microsoft Corporation 04/08/2004 07:56:58 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 04/08/2004 07:56:58 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 04/08/2004 07:56:58 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Sun Microsystems 06/05/2001 04:14:22 24665 C:\WINDOWS\SYSTEM32\plugincpl131.cpl
Microsoft Corporation 04/08/2004 07:56:58 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
Microsoft 02/03/1999 17:10:02 49152 C:\WINDOWS\SYSTEM32\speech.cpl
Microsoft Corporation 04/08/2004 07:56:58 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 18/08/2001 05:00:00 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
Microsoft Corporation 04/08/2004 07:56:58 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 04/08/2004 07:56:58 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 26/05/2005 03:16:30 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 04/08/2004 07:56:58 68608 C:\WINDOWS\SYSTEM32\dllcache\access.cpl
Microsoft Corporation 04/08/2004 07:56:58 155136 C:\WINDOWS\SYSTEM32\dllcache\hdwwiz.cpl
Microsoft Corporation 04/08/2004 07:56:58 129536 C:\WINDOWS\SYSTEM32\dllcache\intl.cpl
Microsoft Corporation 04/08/2004 07:56:58 68608 C:\WINDOWS\SYSTEM32\dllcache\joy.cpl
Microsoft Corporation 18/08/2001 05:00:00 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl
Microsoft Corporation 04/08/2004 07:56:58 257024 C:\WINDOWS\SYSTEM32\dllcache\nusrmgr.cpl
Microsoft Corporation 04/08/2004 07:56:58 32768 C:\WINDOWS\SYSTEM32\dllcache\odbccp32.cpl
Microsoft Corporation 18/08/2001 05:00:00 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl
Microsoft Corporation 04/08/2004 07:56:58 94208 C:\WINDOWS\SYSTEM32\dllcache\timedate.cpl
Microsoft Corporation 26/05/2005 03:16:30 174360 C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl
»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»
Checking files in %ALLUSERSPROFILE%\Startup folder...
28/11/2005 10:34:34 1767 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
31/10/2005 19:42:00 1805 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Broadband Desktop Help.lnk
07/12/2001 18:38:50 HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
04/05/2003 20:07:14 1793 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
26/12/2002 15:58:12 1908 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ulead Photo Express 4.0 SE Calendar Checker .lnk
Checking files in %ALLUSERSPROFILE%\Application Data folder...
07/12/2001 18:23:00 HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini
Checking files in %USERPROFILE%\Startup folder...
07/12/2001 18:38:50 HS 84 C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\desktop.ini
Checking files in %USERPROFILE%\Application Data folder...
07/12/2001 18:23:00 HS 62 C:\Documents and Settings\Administrator\Application Data\desktop.ini
»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
=
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
{D46C76F4-BBBD-434C-A271-17950D53BBC2} = C:\WINDOWS\system32\guard.tmp
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\AJC
{5071CDA5-D3E1-11D5-BFC0-005004A71005} = C:\Program Files\Advanced JPEG Compressor\ContextMenuExt.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\avast
{472083B0-C522-11CF-8763-00608CC02F24} = C:\Program Files\Alwil Software\Avast4\ashShell.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\CuteFTP
{8f7261d0-d2b9-11d2-9909-00605205b24c} = C:\Program Files\GlobalSCAPE\CuteFTP\Cuteshell.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido anti-malware\context.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Yahoo! Mail
{5464D816-CF16-4784-B9F3-75C0DB52B499} = C:\Program Files\Yahoo!\Common\ymmapi.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\avast
{472083B0-C522-11CF-8763-00608CC02F24} = C:\Program Files\Alwil Software\Avast4\ashShell.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\CuteFTP
{8f7261d0-d2b9-11d2-9909-00605205b24c} = C:\Program Files\GlobalSCAPE\CuteFTP\Cuteshell.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido anti-malware\context.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}
= C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\System32\shdocvw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} = MSN : C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
{EF99BD32-C1FB-11D2-892F-0090271D4F88} = Yahoo! Toolbar : C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
ButtonText = BT Yahoo! Services :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66}
MenuText = Uninstall BitDefender Online Scanner v8 :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E023F504-0C5A-4750-A1E7-A9046DEA8A21}
ButtonText = Money Viewer :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = Messenger : C:\Program Files\Messenger\MSMSGS.EXE
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
=
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
EssSpkPhone essspk.exe
S3TRAY2 S3tray2.exe
HP Display Settings C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
CP4HPOT C:\PROGRA~1\HPONE-~1\OneTouch.EXE
hpsysdrv c:\windows\system\hpsysdrv.exe
HP Presentation Ready C:\Program Files\Hewlett-Packard\HP Presentation Ready\PresRdy.exe -r
MMTray "C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe"
NAV Agent C:\PROGRA~1\NORTON~1\navapw32.exe
NeroCheck C:\WINDOWS\system32\NeroCheck.exe
InCD C:\Program Files\Ahead\InCD\InCD.exe
TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
EPSON Stylus C70 Series C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C70 Series" /O5 "LPT1:" /M "Stylus C70"
EPSON Stylus C70 Series (Copy 1) C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P32 "EPSON Stylus C70 Series (Copy 1)" /O6 "USB002" /M "Stylus C70"
gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
Motive SmartBridge C:\PROGRA~1\BTBROA~1\Help\SMARTB~1\BTHelpNotifier.exe
YBrowser C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
mmtask "C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
Symantec NetDriver Monitor C:\PROGRA~1\SYMNET~1\SNDMon.exe
SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
avast! C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background
ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
system.ini 0
win.ini 0
bootini 0
services 0
startup 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = c:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = Explorer.exe
System =
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs
»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 02/03/2006 12:17:19
*****************************************************
Everything ran accordingly except the following problems were encountered:
1) When doing the first hijackthis scan and checking items, I received the following error when fixing these files:
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
http://207.188.7.150/17e07bf45db516f...p/RdxIE601.cab
and
O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} -
http://www.wildtangent.com/multiplay...mmp/wtinst.cab:
"Procedure 016 - DPF...: Error #5 - Invalid procedure call or argument."
2) You asked me to locate and delete the following files:
C:\Program Files\Network Monitor\
C:\Program Files\WildTangent\
C:\Program Files\Common Files\VCClient\
I successfully deleted Network Monitor. WildTangent and VCClient were not there.
Before I carried out these procedures, the computer displayed an error RUNDLL file relating to WildTangent on startup. This does not happen now.
Both the command prompt and the task manager are now operable! :-)
The internet appears to be running faster, however the computer seems slower on startup. Having said that, I have installed AdAware, avast!, and ewido and other things as required.
Please advise if there is anything else I am required to do.
Thanks again in advance.
col