Help with spyware-hijackthis log

darishetty · 12-31-2005, 10:37 AM

Hi all,
my computer is infected with spyware. Can any one of you help me in getting rid of this? Here is Hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 10:18:38 AM, on 12/31/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\ISS\issSensors\DesktopProtection\blackd.exe
C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe
C:\Program Files\NavNT\defwatch.exe
c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Blazent\BlazentAgent\bin\BZController.exe
C:\WINNT\System32\Qinst.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\CCM\CcmExec.exe
C:\WINNT\System32\MsgSys.EXE
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINNT\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\System32\RUNDLL32.EXE
C:\windows\adtech2006a.exe
C:\WINNT\System32\igps.exe
C:\WINNT\System32\pgws.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\VCClient\VCClient.exe
C:\Program Files\Common Files\VCClient\VCMain.exe
C:\Program Files\ccrb\tere.exe
C:\WINNT\SYSTEM32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\ddarish\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://theq.qwest.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\Program Files\QL\qlink32.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [BlazentEnvironmentVariableCollector] C:\Program Files\Blazent\BlazentAgent\bin\BZEnvironmentVariableCollector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe
O4 - HKLM\..\Run: [0wao0o9s.dll] RUNDLL32.EXE 0wao0o9s.dll,b 106225644
O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [lspins] "C:\WINNT\System32\igps.exe"
O4 - HKLM\..\Run: [winsync] C:\WINNT\System32\pkqoaw.exe reg_run
O4 - HKLM\..\Run: [hgqhp.exe] C:\WINNT\System32\hgqhp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [Pase] "C:\Program Files\ccrb\tere.exe" -vt yazr
O4 - HKCU\..\Run: [Ypwiyhh] C:\WINNT\System32\??crosoft.NET\mshta.exe
O4 - Global Startup: DOG_CONFIG UTILITY.LNK = C:\Program Files\Qwest Browsers\ConfigLauncher.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://theq.qwest.net
O15 - Trusted Zone: http://*.qtomaacmw01
O15 - Trusted Zone: http://deskopweb.qwest.net
O15 - Trusted Zone: http://doweb.qwest.net
O15 - Trusted Zone: http://theq.qwest.net
O16 - DPF: {11B2C0D3-DFFB-11D3-9253-00500498D7E5} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/1223079d...p/RdxIE601.cab
O16 - DPF: {6DA10734-25FD-4350-A8FF-B5A6DBB49680} (WAFUploader Class) - https://www.web-a-file.com/webafileuploader.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - http://203.199.42.226/Media/visitorchat/TLIEFlash.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) - http://imlive.com/ChatSource/gVideoContol.cab
O16 - DPF: {BADA82CB-BF48-4D76-9611-78E2C6F49F03} (BolDownloader Control) - http://messenger.rediff.com/newbol/Bol.CAB
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AD.QINTRA.COM
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = uswc.uswest.com
O17 - HKLM\Software\..\Telephony: DomainName = AD.QINTRA.COM
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BC9ECE2-073B-476C-8109-010D10D2A472}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: Domain = AD.QINTRA.COM
O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B212F05-A9A5-475F-BBBC-07042B203A05}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CF58A82-4251-49B6-BAD5-8B68D12CF5DF}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE72614-EAC2-4966-91FF-D35171095447}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA2E7D92-348D-4C6C-AD08-452A5671B942}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB973A40-52DE-4BA9-A5C5-852F43434744}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2F9F882-346D-48BA-AC04-C68D0C26546A}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = uswc.uswest.com,qwest.net,qintra.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ad.qintra.com,qintra.com,uswc.uswest.com,qwest.net,lci.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\Program Files\QL\qlink32.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: Setup - C:\WINNT\system32\j06mlaj11do.dll
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\blackd.exe
O23 - Service: Blazent Agent - Blazent, Inc. - C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: EXE_CRON - - c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Qinst - Unknown owner - C:\WINNT\System32\Qinst.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\RapApp.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Thanks in advance.
..dd

sUBs · 12-31-2005, 11:01 AM

Please do the following:

Download & immediately run - L2MFix.exe
Click "Install" to extract the contents to a newly created folder.

Close any programs you have open since this step requires a reboot.

From the l2mfix folder, double click l2mfix.bat
Select option #2 for Run Fix by typing 2 and then pressing enter ONCE.

Do NOT depress any keys on your keyboard until the tool request you to "press any key to reboot"

On the reboot notepad will open with a log. Copy/paste the contents of that log back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

If after the reboot the log does not open double click on it in the l2mfix folder to locate log.txt.

If you receive an error - \system32\Autoexec.nt is not suitable for running MS-Dos applications, you will need to visit this website to download additional files.

darishetty · 12-31-2005, 12:35 PM

Thanks Sub for quick response.
Here are contents of L2mfix:
L2mfix Beta 122705
Creating Account.
The command completed successfully.

Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINNT\SYSTEM32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 332 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 404 'winlogon.exe'
Killing PID 404 'winlogon.exe'
Killing PID 404 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 2352 'explorer.exe'
Killing PID 2352 'explorer.exe'
Killing PID 2352 'explorer.exe'
Killing PID 2352 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 2728 'rundll32.exe'
Killing PID 3860 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
moving: C:\WINNT\system32\DuvX.dll
Successfully Moved: C:\WINNT\system32\DuvX.dll
moving: C:\WINNT\system32\dvcobj.dll
Successfully Moved: C:\WINNT\system32\dvcobj.dll
moving: C:\WINNT\system32\dwime.dll
Successfully Moved: C:\WINNT\system32\dwime.dll
moving: C:\WINNT\system32\e8020idoe80c0.dll
Successfully Moved: C:\WINNT\system32\e8020idoe80c0.dll
moving: C:\WINNT\system32\j06mlaj11do.dll
Successfully Moved: C:\WINNT\system32\j06mlaj11do.dll
moving: C:\WINNT\system32\guard.tmp
Successfully Moved: C:\WINNT\system32\guard.tmp

Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"
"StartShell"="NavStartShellEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Setup]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\j06mlaj11do.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

The following are the files found:
****************************************************************************
C:\WINNT\system32\DuvX.dll
C:\WINNT\system32\dvcobj.dll
C:\WINNT\system32\dwime.dll
C:\WINNT\system32\e8020idoe80c0.dll
C:\WINNT\system32\j06mlaj11do.dll
C:\WINNT\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}\InprocServer32]
@="C:\\WINNT\\system32\\DuvX.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}"=-
[-HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/DuvX.dll (148 bytes security) (deflated 5%)
adding: dlls/dvcobj.dll (148 bytes security) (deflated 5%)
adding: dlls/dwime.dll (148 bytes security) (deflated 5%)
adding: dlls/e8020idoe80c0.dll (148 bytes security) (deflated 5%)
adding: dlls/guard.tmp (148 bytes security) (deflated 5%)
adding: dlls/j06mlaj11do.dll (148 bytes security) (deflated 5%)
adding: backregs/91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (188 bytes security) (deflated 88%)
adding: backregs/shell.reg (188 bytes security) (deflated 73%)

Thanks once again.

darishetty · 12-31-2005, 12:38 PM

Hi,
Here is the latest Hijackthis log file:
Logfile of HijackThis v1.99.1
Scan saved at 12:38:18 PM, on 12/31/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\ISS\issSensors\DesktopProtection\blackd.exe
C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe
C:\Program Files\NavNT\defwatch.exe
c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\System32\Qinst.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\CCM\CcmExec.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINNT\System32\msiexec.exe
C:\WINNT\System32\MsgSys.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Blazent\BlazentAgent\bin\BZController.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\System32\RUNDLL32.EXE
C:\windows\adtech2006a.exe
C:\WINNT\System32\igps.exe
C:\WINNT\System32\pgws.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Common Files\VCClient\VCClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\VCClient\VCMain.exe
C:\Program Files\ccrb\tere.exe
C:\WINNT\System32\??crosoft.NET\mshta.exe
C:\navupdate\WiseUpdt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Blazent\BlazentAgent\bin\BZSoftwareInventoryCollector.exe
C:\Documents and Settings\ddarish\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://theq.qwest.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\Program Files\QL\qlink32.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [BlazentEnvironmentVariableCollector] C:\Program Files\Blazent\BlazentAgent\bin\BZEnvironmentVariableCollector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe
O4 - HKLM\..\Run: [0wao0o9s.dll] RUNDLL32.EXE 0wao0o9s.dll,b 106225644
O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [lspins] "C:\WINNT\System32\igps.exe"
O4 - HKLM\..\Run: [winsync] C:\WINNT\System32\pkqoaw.exe reg_run
O4 - HKLM\..\Run: [yaemu.exe] C:\WINNT\System32\yaemu.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [Pase] "C:\Program Files\ccrb\tere.exe" -vt yazr
O4 - HKCU\..\Run: [Ypwiyhh] C:\WINNT\System32\??crosoft.NET\mshta.exe
O4 - Global Startup: DOG_CONFIG UTILITY.LNK = C:\Program Files\Qwest Browsers\ConfigLauncher.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://theq.qwest.net
O15 - Trusted Zone: http://*.qtomaacmw01
O15 - Trusted Zone: http://deskopweb.qwest.net
O15 - Trusted Zone: http://doweb.qwest.net
O15 - Trusted Zone: http://theq.qwest.net
O15 - Trusted Zone: http://*.sdg
O16 - DPF: {11B2C0D3-DFFB-11D3-9253-00500498D7E5} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/1223079d...p/RdxIE601.cab
O16 - DPF: {6DA10734-25FD-4350-A8FF-B5A6DBB49680} (WAFUploader Class) - https://www.web-a-file.com/webafileuploader.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - http://203.199.42.226/Media/visitorchat/TLIEFlash.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) - http://imlive.com/ChatSource/gVideoContol.cab
O16 - DPF: {BADA82CB-BF48-4D76-9611-78E2C6F49F03} (BolDownloader Control) - http://messenger.rediff.com/newbol/Bol.CAB
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AD.QINTRA.COM
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = uswc.uswest.com
O17 - HKLM\Software\..\Telephony: DomainName = AD.QINTRA.COM
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BC9ECE2-073B-476C-8109-010D10D2A472}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: Domain = AD.QINTRA.COM
O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B212F05-A9A5-475F-BBBC-07042B203A05}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CF58A82-4251-49B6-BAD5-8B68D12CF5DF}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE72614-EAC2-4966-91FF-D35171095447}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA2E7D92-348D-4C6C-AD08-452A5671B942}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB973A40-52DE-4BA9-A5C5-852F43434744}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2F9F882-346D-48BA-AC04-C68D0C26546A}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = uswc.uswest.com,qwest.net,qintra.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ad.qintra.com,qintra.com,uswc.uswest.com,qwest.net,lci.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\Program Files\QL\qlink32.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: Setup - C:\WINNT\system32\j06mlaj11do.dll (file missing)
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\blackd.exe
O23 - Service: Blazent Agent - Blazent, Inc. - C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: EXE_CRON - - c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Qinst - Unknown owner - C:\WINNT\System32\Qinst.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\RapApp.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Thanks,
dd

sUBs · 12-31-2005, 12:40 PM

I would also like a copy of your uninstall list. You may obtain one by doing so..
Start HJT & goto Config > Misc Tools - Open Uninstall Manager
Click the Save List button & post the the resultant log.

Please highlight any entries that looks suspicious to you

darishetty · 12-31-2005, 12:46 PM

.NET Certficate Authority Browser Patch - Pkg #1054
Ad-Aware SE Personal
Adobe Reader 6.0.1
Agere Systems AC'97 Modem
Blazent Agent
Broadcom 440x 10/100 Integrated Controller
CentraOne
Citrix Program Neighborhood
ComcastSUPPORT
Desktop Weather by The Weather Channel
DH
DirectX 9 Hotfix - KB839643
DivX
DivX Player
ELSA Configuration Manager
Faxcom for SMTP Client
Google Toolbar for Internet Explorer
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 1.99.1
IBM Integrated 56K Modem
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Ethernet Adapter and Software
Java 2 Runtime Environment Standard Edition v1.3.1_01
Java 2 Runtime Environment, SE v1.4.2_01
Java 2 Runtime Environment, SE v1.4.2_07
Java 2 SDK, SE v1.4.2_01
LiveUpdate 1.7 (Symantec Corporation)
Macromedia Flash Player 8
MetaFrame Presentation Server Client
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft Chat 2.5
Microsoft Data Access Components KB870669
Microsoft Office Converter Pack
Microsoft Office XP Professional
Microsoft Office XP Web Components
Microsoft Outlook 2002
Microsoft Visio Viewer 2002
Mozilla Firefox (1.5)
MSN Messenger 7.5
NAV.7.61.x.2003.F
Norton AntiVirus Corporate Edition
Outlook Express Q823353
PC Camera
PC Camera (6025 VGA)
QuicklinksQuickTime
RealPlayer
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905495)
Security Update for Windows XP (KB905749)
SoundMAX
Spybot - Search & Destroy 1.4
Spyware Doctor 3.2
Sun Java 2 Runtime Environment
Synaptics Pointing Device Driver
TaxACT 2005
Texas Instruments PCIxx20 drivers.
USB 2.0 Image
Wall Data Software
Weather Services
Winamp (remove only)
Windows Media Player 9 Series
Windows Messenger 5.0
Windows XP Hotfix - KB824151
Windows XP Hotfix - KB828028
Windows XP Hotfix - KB833987
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB839643
Windows XP Hotfix - KB839645
Windows XP Hotfix - KB840315
Windows XP Hotfix - KB840374
Windows XP Hotfix - KB840987
Windows XP Hotfix - KB841356
Windows XP Hotfix - KB841533
Windows XP Hotfix - KB841873
Windows XP Hotfix - KB842773
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB871250
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB873376
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB889293
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891711
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB892944
Windows XP Hotfix - KB893086
Windows XP Hotfix - KB896688
Yahoo! Internet Mail
Yahoo! Messenger
Yazzle Sudoku by OIN

sUBs · 12-31-2005, 12:54 PM

Please uninstall these programs:

Yazzle Sudoku by OIN
Quicklinks

Start HJT & goto Config > Misc Tools - Open Uninstall Manager
From the box on the left, select each entry & look up the the uninstall command from the right :

DH

Please let me know each entry's uninstall command

Please visit this website - http://virusscan.jotti.org
Submit these files for a comprehensive scan & then post the results back here.

c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron. exe
C:\WINNT\System32\Qinst.exe

darishetty · 12-31-2005, 01:02 PM

When I am trying to upload the file "C:\WINNT\DHU.exe" I am getting following error:
"The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file."

darishetty · 12-31-2005, 01:05 PM

For C:\WINNT\System32\Qinst.exe: I got following report:

Service load: 0% 100%

File: Qinst.exe_
Status: OK
MD5 4f9c6afec4d35d8d4f78555cc84e5e61
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

darishetty · 12-31-2005, 01:06 PM

For c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron. exe I am getting error:
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

sUBs · 12-31-2005, 01:06 PM

Ermm..where did you get C:\WINNT\DHU.exe from? Is it from the uninstall command for the program -DH ?

I only requested for these to be scanned at jotti:

c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron. exe
C:\WINNT\System32\Qinst.exe

darishetty · 12-31-2005, 01:12 PM

Uninstall command for the program DH is C:\WINNT\DHU.exe.

For c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron. exe I am getting error:
"The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file"

Thanks

sUBs · 12-31-2005, 01:14 PM

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * *

Download & install CleanUp.exe (not recommended for WinXP64)

Download KillBox v2.0.0.175.exe (it's important that you get version v2.0.0.175)

WinPfind.zip - download & extract the contents to it's own folder at the root of drive C

TrackQoo.zip

Download and install Ewido Security Suite

When installing, under "Additional Options",
- uncheck - Install background guard
Have Ewido update itself & then exit the program.

If you are having problems with the updater, you can use this link to manually update Ewido

Please download & Install - FixWareout.exe

When you reach the final page of the installation process, make sure "Run fixit" is checked.
Follow the on-screen prompts & reboot your computer when instructed to do so.

**Do not be alarmed if your computer takes longer than usual to load.

After you have restarted, wait for HijackThis to launch automatically.
With HiJackThis & place a check next to these items and select "Fix checked":

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\Program Files\QL\qlink32.dll
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe
O4 - HKLM\..\Run: [0wao0o9s.dll] RUNDLL32.EXE 0wao0o9s.dll,b 106225644
O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [lspins] "C:\WINNT\System32\igps.exe"
O4 - HKLM\..\Run: [winsync] C:\WINNT\System32\pkqoaw.exe reg_run
O4 - HKLM\..\Run: [yaemu.exe] C:\WINNT\System32\yaemu.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [Pase] "C:\Program Files\ccrb\tere.exe" -vt yazr
O4 - HKCU\..\Run: [Ypwiyhh] C:\WINNT\System32\??crosoft.NET\mshta.exe
O16 - DPF: {11B2C0D3-DFFB-11D3-9253-00500498D7E5} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BC9ECE2-073B-476C-8109-010D10D2A472}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B212F05-A9A5-475F-BBBC-07042B203A05}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CF58A82-4251-49B6-BAD5-8B68D12CF5DF}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE72614-EAC2-4966-91FF-D35171095447}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA2E7D92-348D-4C6C-AD08-452A5671B942}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB973A40-52DE-4BA9-A5C5-852F43434744}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2F9F882-346D-48BA-AC04-C68D0C26546A}: NameServer = 85.255.116.104,85.255.112.213
O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\Program Files\QL\qlink32.dll
O20 - Winlogon Notify: Setup - C:\WINNT\system32\j06mlaj11do.dll (file missing)

Close HijackThis, and click OK to proceed.

FixWareOut will produce a logfile, report.txt located within the C:\fixwareout folder

* * * * * * KILLBOX * * * * * * * * * * * * * * * * * * * * * * *

Launch KillBox.exe & select the following options:

delete on Reboot

All files (if available)

Use your mouse to select all the filenames listed below & then right-click & select Copy

C:\windows\adtech2006a.exe
C:\WINNT\System32\igps.exe
C:\WINNT\System32\pgws.exe
C:\windows\timessquare.exe
C:\WINNT\System32\0wao0o9s.dll
C:\WINNT\DHU.exe
c:\drsmartloadb.exe
C:\WINNT\System32\pkqoaw.exe
C:\WINNT\System32\yaemu.exe

* Go to the File menu, and choose Paste from Clipboard
* Click the RED X button.
* Click Yes at the Delete on Reboot prompt.
* Click Yes at the 'Pending Operations prompt'.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, download and run missingfilesetup.exe. Then try Killbox again.

* * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * *

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the option to run Windows in Safe Mode.

* * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * *

If you have not done so already, please enable the viewing of Hidden files
From Windows Explorer, go to Tools -> Folder Options -> View tab.

Tick - 'Show hidden files and folder'
Untick - 'Hide file extensions for known types'
Untick - 'Hide protected operating system files'
Click Yes to confirm & then click OK

Locate and delete the following files/folders: (let me know if you fail to find/delete any)

C:\Program Files\QL\
C:\PROGRA~1\BUTTER~1\
C:\Program Files\Common Files\VCClient\
C:\Program Files\ccrb\
C:\WINNT\System32\??crosoft.NET\

* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * *

Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider initially to Standard CleanUp!
3. Uncheck the following:

Delete Newsgroup cache
Delete Newsgroup Subscriptions
Scan local drives for temporary files

4. Click OK
5. Press the CleanUp! button to start the program.
6. Do NOT reboot/logoff if prompted.

* CleanUp! will not create any backups!!

* * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * *

Run Ewido with it's updated definitions:(...it's important that all windows must be closed)

Click Scanner
Click Complete System Scan to begin scanning.
Click OK when prompted to clean files

With the first file it prompts to clean, select the option:

"Perform action on all infections"
.Choose clean and click OK.

Once finished, click the Save report button & save the report to your desktop

** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete.

* * * * * * DEEP SCAN * * * * * * * * * * * * * * * * * * * *

1. From within the WinPFind folder, double click WinPFind.exe
2. Click Start Scan
3. Once the Scan is complete, it will create a report in a text file
4. Go to the WinPFind folder & locate WinPFind.txt
5. Post the results in your next reply!

** This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

* * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * *

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

From within TrackQoo.zip, double-click on TrackQoo1.vbs. Wait a few seconds and a notepad page will pop up, Copy & Paste those results in your next reply.
* If your Antivirus has Script Blocking, you will get a Pop Up Windows asking you what to do. Allow this Entire Script to Run, its harmless!

* * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * *

In your next post, please include fresh logs from:

FixWareout's log

HiJackThis log

Online Scan

WinPfind

TrackQoo

Ewido

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

darishetty · 01-01-2006, 10:06 AM

Here are final logs:
1) Fixwareour log:
Fixwareout ver 1.003
Last edited 12/5/2005
Post this report in the forums please

Reg Entries that were deleted

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Search by size and names...

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

2)Hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 9:52:37 AM, on 1/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\ISS\issSensors\DesktopProtection\blackd.exe
C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Blazent\BlazentAgent\bin\BZController.exe
c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINNT\System32\Qinst.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\CCM\CcmExec.exe
C:\WINNT\System32\MsgSys.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\System32\ctfmon.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\ddarish\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BlazentEnvironmentVariableCollector] C:\Program Files\Blazent\BlazentAgent\bin\BZEnvironmentVariableCollector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [winsync] C:\WINNT\System32\pkqoaw.exe reg_run
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: DOG_CONFIG UTILITY.LNK = C:\Program Files\Qwest Browsers\ConfigLauncher.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://theq.qwest.net
O15 - Trusted Zone: http://*.qtomaacmw01
O15 - Trusted Zone: http://deskopweb.qwest.net
O15 - Trusted Zone: http://doweb.qwest.net
O15 - Trusted Zone: http://theq.qwest.net
O15 - Trusted Zone: http://*.sdg
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/1223079d...p/RdxIE601.cab
O16 - DPF: {6DA10734-25FD-4350-A8FF-B5A6DBB49680} (WAFUploader Class) - https://www.web-a-file.com/webafileuploader.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - http://203.199.42.226/Media/visitorchat/TLIEFlash.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) - http://imlive.com/ChatSource/gVideoContol.cab
O16 - DPF: {BADA82CB-BF48-4D76-9611-78E2C6F49F03} (BolDownloader Control) - http://messenger.rediff.com/newbol/Bol.CAB
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AD.QINTRA.COM
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = uswc.uswest.com
O17 - HKLM\Software\..\Telephony: DomainName = AD.QINTRA.COM
O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: NameServer = 85.255.116.104,85.255.112.213
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = uswc.uswest.com,qwest.net,qintra.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ad.qintra.com,qintra.com,uswc.uswest.com,qwest.net,lci.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\blackd.exe
O23 - Service: Blazent Agent - Blazent, Inc. - C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: EXE_CRON - - c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Qinst - Unknown owner - C:\WINNT\System32\Qinst.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\RapApp.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

3)Trackqoo log
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="C:\\Program Files\\NavNT\\vptray.exe"
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"BlazentEnvironmentVariableCollector"="C:\\Program Files\\Blazent\\BlazentAgent\\bin\\BZEnvironmentVariableCollector.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_07\\bin\\jusched.exe"
"tgcmd"="\"C:\\Program Files\\support.com\\bin\\tgcmd.exe\" /server"
"winsync"="C:\\WINNT\\System32\\pkqoaw.exe reg_run"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

-----------------
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers

Subkey --- ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}
C:\Program Files\ewido anti-malware\context.dll

Subkey --- LDVPMenu
{BDA77241-42F6-11d0-85E2-00AA001FE28C}
C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll

Subkey --- mqskyfmy
{7df3f00a-e833-4db7-838a-3c71a275b24c}
C:\WINNT\System32\klqkm.dll

Subkey --- Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03}
C:\WINNT\System32\cscui.dll

Subkey --- Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936}
C:\WINNT\system32\SHELL32.dll

Subkey --- Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46}
C:\WINNT\system32\SHELL32.dll

Subkey --- WinRAR

Subkey --- Yahoo! Mail
{5464D816-CF16-4784-B9F3-75C0DB52B499}
C:\PROGRA~1\Yahoo!\Common\ymmapi.dll

Subkey --- {a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin
C:\WINNT\system32\SHELL32.dll

=====================

HKEY_CLASSES_ROOT\Folder\shellex\ColumnHandlers

Subkey --- {0D2E74C4-3C34-11d2-A27E-00C04FC30871}
C:\WINNT\system32\SHELL32.dll

Subkey --- {24F14F01-7B1C-11d1-838f-0000F80461CF}
C:\WINNT\system32\SHELL32.dll

Subkey --- {24F14F02-7B1C-11d1-838f-0000F80461CF}
C:\WINNT\system32\SHELL32.dll

Subkey --- {66742402-F9B9-11D1-A202-0000F81FEDEE}
C:\WINNT\system32\SHELL32.dll

==============================
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

desktop.ini
DOG_CONFIG UTILITY.LNK
Microsoft Office.lnk
oiwq.exe
==============================
C:\Documents and Settings\ddarish\Start Menu\Programs\Startup

desktop.ini
DOG_CONFIG UTILITY.LNK
Microsoft Office.lnk
oiwq.exe
desktop.ini
==============================
C:\WINNT\system32 cpl files

access.cpl Microsoft Corporation
appwiz.cpl Microsoft Corporation
desk.cpl Microsoft Corporation
hdwwiz.cpl Microsoft Corporation
igfxcpl.cpl Intel Corporation
inetcpl.cpl Microsoft Corporation
intl.cpl Microsoft Corporation
irprops.cpl Microsoft Corporation
joy.cpl Microsoft Corporation
jpicpl32.cpl Sun Microsystems
main.cpl Microsoft Corporation
mmsys.cpl Microsoft Corporation
ncpa.cpl Microsoft Corporation
nusrmgr.cpl Microsoft Corporation
nwc.cpl Microsoft Corporation
odbccp32.cpl Microsoft Corporation
plugincpl131_01.cpl Sun Microsystems
powercfg.cpl Microsoft Corporation
QuickTime.cpl Apple Computer, Inc.
sysdm.cpl Microsoft Corporation
telephon.cpl Microsoft Corporation
timedate.cpl Microsoft Corporation
wuaucpl.cpl Microsoft Corporation
wxfw.cpl The Weather Channel Interactive

darishetty · 01-01-2006, 10:08 AM

4)Ewido report:

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 7:27:54 AM, 1/1/2006
+ Report-Checksum: C7BFE5B8

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Spyware.WebSearch : Cleaned with backup
C:\drsmartload1.exe -> Downloader.Adload.l : Cleaned with backup
C:\inrh9400.exe -> Downloader.Small.bke : Cleaned with backup
C:\installerus.exe -> Downloader.Qoologic.at : Cleaned with backup
C:\inst_0004.exe -> Downloader.Small.cam : Cleaned with backup
C:\l2mfix\l2mfix\backup.zip/dlls/DuvX.dll -> Spyware.Look2Me : Error during cleaning
C:\l2mfix\l2mfix\backup.zip/dlls/dvcobj.dll -> Spyware.Look2Me : Error during cleaning
C:\l2mfix\l2mfix\backup.zip/dlls/dwime.dll -> Spyware.Look2Me : Error during cleaning
C:\l2mfix\l2mfix\backup.zip/dlls/e8020idoe80c0.dll -> Spyware.Look2Me : Error during cleaning
C:\l2mfix\l2mfix\backup.zip/dlls/guard.tmp -> Spyware.Look2Me : Error during cleaning
C:\l2mfix\l2mfix\backup.zip/dlls/j06mlaj11do.dll -> Spyware.Look2Me : Error during cleaning
C:\l2mfix\l2mfix\dlls\DuvX.dll -> Spyware.Look2Me : Cleaned with backup
C:\l2mfix\l2mfix\dlls\dvcobj.dll -> Spyware.Look2Me : Cleaned with backup
C:\l2mfix\l2mfix\dlls\dwime.dll -> Spyware.Look2Me : Cleaned with backup
C:\l2mfix\l2mfix\dlls\e8020idoe80c0.dll -> Spyware.Look2Me : Cleaned with backup
C:\l2mfix\l2mfix\dlls\guard.tmp -> Spyware.Look2Me : Cleaned with backup
C:\l2mfix\l2mfix\dlls\j06mlaj11do.dll -> Spyware.Look2Me : Cleaned with backup
C:\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Cleaned with backup
:mozilla.8:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.9:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.10:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.20:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.36:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.37:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.38:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.39:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.41:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.42:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.43:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.44:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.45:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.51:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.52:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.53:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.82:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.83:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.102:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.167:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.169:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.180:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.195:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.196:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.197:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.198:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.199:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.228:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.229:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.230:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.231:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.232:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.233:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.234:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.271:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.272:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.273:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.306:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.307:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.308:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.309:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.311:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c24e2396_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.8:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.9:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.10:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.20:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.36:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.37:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.38:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.39:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.41:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.42:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.43:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.44:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.45:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.51:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.52:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.53:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.82:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.83:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.102:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.167:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.169:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.180:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.195:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.196:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.197:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.198:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.199:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.228:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.229:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.230:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.231:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.232:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.233:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.234:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.271:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.272:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.273:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.306:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.307:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.308:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.309:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.311:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5c525b2ba_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.8:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.9:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.10:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.20:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.36:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.37:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.38:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.39:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.41:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.42:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.43:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.44:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.45:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.51:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.52:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.53:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.82:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.83:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.102:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.167:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.169:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.180:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.195:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.196:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.197:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.198:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.199:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.228:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.229:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.230:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.231:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.232:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.233:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.234:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.271:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.272:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.273:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.306:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.307:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.308:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.309:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.311:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\Co\cookies.txt\29981_5d56da329_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.9:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.10:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.15:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.25:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.28:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.41:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.42:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.43:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.44:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.46:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.47:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.48:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.49:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.50:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.56:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.57:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.58:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.87:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.88:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.107:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.172:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.174:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.185:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.200:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.201:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.202:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.203:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.204:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.233:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.234:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.235:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.236:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.237:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.238:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.239:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.276:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.277:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.278:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.314:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.315:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.317:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.318:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.319:C:\Program Files\support.com\backup\Co\cookies.txt\30025_50776bd97_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.8:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.9:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.10:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.17:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.22:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.27:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.40:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.41:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.42:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.43:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.45:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.46:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.47:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.48:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.49:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.55:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.56:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.57:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.86:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.87:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.106:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.171:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.173:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.184:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.199:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.200:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.201:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.202:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.203:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.232:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.233:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.234:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.235:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.236:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.237:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.238:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.275:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.276:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.277:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.311:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.314:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.316:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.317:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.318:C:\Program Files\support.com\backup\Co\cookies.txt\30347_507da89fa_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.6:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.7:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.20:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.21:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.25:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.26:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.38:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.39:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.40:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.41:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.42:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.43:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.44:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.46:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.47:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.48:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.49:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.50:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.51:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.58:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.59:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.60:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.61:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.87:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.95:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.96:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.122:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.123:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.204:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.206:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.217:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.232:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.233:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.234:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.235:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.236:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.237:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.270:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.271:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.272:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.273:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.274:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.275:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.276:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.277:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.317:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.318:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.319:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.367:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.368:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.369:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.370:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.372:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.373:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.374:C:\Program Files\support.com\backup\Co\cookies.txt\34826_5cf4b8587_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.5:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.6:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.10:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.17:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.20:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.22:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.25:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.37:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.38:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.39:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.40:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.41:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.42:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.43:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.45:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.46:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.47:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.48:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.49:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.50:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.57:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.58:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.59:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.60:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.86:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.94:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.95:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.121:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.122:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.203:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.205:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.216:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.231:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.232:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.233:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.234:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.235:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.236:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.269:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.270:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.271:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.272:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.273:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.274:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.275:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.276:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.316:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.317:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.318:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.366:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.367:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.368:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.369:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.371:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.372:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.373:C:\Program Files\support.com\backup\Co\cookies.txt\35206_5d34a14d4_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Atdmt : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.15:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.16:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.17:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.20:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.21:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.22:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.25:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.26:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.27:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.28:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.29:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Valueclick : Error during cleaning
:mozilla.30:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Valueclick : Error during cleaning
:mozilla.51:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.52:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.83:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.84:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.85:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.86:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.117:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Webtrendslive : Error during cleaning
:mozilla.133:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.134:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.135:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.136:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.137:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.138:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.140:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.141:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.142:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.156:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.166:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.193:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.201:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.213:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.214:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.215:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.244:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.245:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.246:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.247:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.248:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.249:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.262:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.263:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.266:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.267:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.288:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.289:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.290:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.298:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.299:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.300:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.301:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.302:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.303:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.304:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.307:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.308:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.309:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.310:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.314:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.315:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.322:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.326:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.327:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.330:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.331:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.332:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.333:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.335:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.350:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.351:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.388:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.389:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.390:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.394:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.395:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.396:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.400:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.408:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.409:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.410:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.415:C:\Program Files\support.com\backup\Co\cookies.txt\40061_58d8851db_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Atdmt : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.15:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.16:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.17:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.20:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.21:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.25:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.26:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.27:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.28:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Valueclick : Error during cleaning
:mozilla.29:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Valueclick : Error during cleaning
:mozilla.50:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.51:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.82:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.83:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.84:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.85:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.116:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Webtrendslive : Error during cleaning
:mozilla.132:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.133:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.134:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.135:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.136:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.137:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.139:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.140:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.141:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.155:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.165:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.192:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.200:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.212:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.213:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.214:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.243:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.244:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.245:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.246:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.247:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.248:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.261:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.262:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.265:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.266:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.287:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.288:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.289:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.297:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.298:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.299:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.300:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.301:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.302:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.303:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.306:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.307:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.308:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.309:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.311:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.314:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.321:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.325:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.326:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.329:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.330:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.331:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.332:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.334:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.349:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.350:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.387:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.388:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.389:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.393:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.394:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.395:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.399:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.407:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.408:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.409:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.414:C:\Program Files\support.com\backup\Co\cookies.txt\40478_55e0b2bb0_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Atdmt : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.15:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.16:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.17:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.18:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.19:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.20:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.21:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.23:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.25:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Fastclick : Error during cleaning
:mozilla.26:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.27:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.28:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Valueclick : Error during cleaning
:mozilla.29:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Valueclick : Error during cleaning
:mozilla.50:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.51:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.82:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.83:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.84:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.85:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.116:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Webtrendslive : Error during cleaning
:mozilla.132:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.133:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.134:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.135:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.136:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.137:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.139:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.140:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.141:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.155:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Tribalfusion : Error during cleaning
:mozilla.165:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Tradedoubler : Error during cleaning
:mozilla.192:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Questionmarket : Error during cleaning
:mozilla.200:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
:mozilla.212:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.213:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.214:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.243:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.244:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.245:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.246:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.247:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Addynamix : Error during cleaning
:mozilla.248:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.261:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.262:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.265:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.266:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.287:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.288:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hypertracker : Error during cleaning
:mozilla.289:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.297:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.298:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.299:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.300:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.301:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.302:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.303:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.306:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.307:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.308:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.309:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Specificclick : Error during cleaning
:mozilla.311:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.312:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.313:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.314:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Casalemedia : Error during cleaning
:mozilla.321:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.325:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.326:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.329:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.330:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.331:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.332:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Falkag : Error during cleaning
:mozilla.334:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.349:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.350:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.387:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.388:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.389:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.393:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.394:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.395:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.399:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Hitslink : Error during cleaning
:mozilla.407:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.408:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.409:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Yieldmanager : Error during cleaning
:mozilla.414:C:\Program Files\support.com\backup\Co\cookies.txt\40478_579d9bb17_/cookies.txt -> Spyware.Cookie.Overture : Error during cleaning
C:\stub_113_4_0_4_0.exe -> Downloader.TSUpdate.o : Cleaned with backup
C:\USWINST\TOOLS\REBOOT.EXE -> Trojan.Reboot : Cleaned with backup
C:\USWINST\TOOLS\reboot95.exe -> Trojan.Reboot : Cleaned with backup
C:\WINNT\country.exe -> Trojan.Small : Cleaned with backup
C:\WINNT\DH.dll -> Hijacker.Small.jf : Cleaned with backup
C:\WINNT\kl.exe -> Trojan.Agent.bu : Cleaned with backup
C:\WINNT\ms1.exe -> Downloader.Tiny.al : Cleaned with backup
C:\WINNT\system32\paradise.raw -> Proxy.Lager.f : Cleaned with backup
C:\WINNT\system32\Quicklinks.exe -> Adware.MDH : Cleaned with backup
C:\WINNT\system32\sywsvcs.exe -> Proxy.Lager.f : Cleaned with backup
C:\WINNT\tool1.exe -> Trojan.Small : Cleaned with backup
C:\WINNT\tool2.exe -> Not-A-Virus.Hoax.Win32.Renos.aj : Cleaned with backup
C:\WINNT\tool3.exe -> Downloader.Small.bwr : Cleaned with backup
C:\WINNT\tool4.exe -> Trojan.Small : Cleaned with backup
C:\WINNT\tool5.exe -> Trojan.Small : Cleaned with backup
C:\WINNT\toolbar.exe -> Downloader.Adload.j : Cleaned with backup

::Report End

darishetty · 01-01-2006, 10:10 AM

5)Online kaspersky scan report:
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, January 01, 2006 09:51:48
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 1/01/2006
Kaspersky Anti-Virus database records: 168523
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 41342
Number of viruses found: 43
Number of infected objects: 94
Number of suspicious objects: 0
Duration of the scan process: 6220 sec

Infected Object Name - Virus Name
C:\AGEU_SilentSudokuInstaller.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk
C:\AGEU_SilentSudokuInstaller.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk
C:\AGEU_SilentSudokuInstaller.exe Infected: Trojan-Dropper.Win32.VB.kk
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\03A40000.VBN Infected: Exploit.HTML.Mht
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\03A40001.VBN Infected: Trojan.Java.ClassLoader.f
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\03A40002.VBN Infected: Exploit.Java.ByteVerify
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04040000.VBN Infected: Trojan.Java.ClassLoader.Dummy.d
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\045C0000.VBN Infected: Exploit.HTML.Mht
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN/GetAccess.class Infected: Trojan.Java.ClassLoader.c
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN/BlackBox.class Infected: Exploit.Java.ByteVerify
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN/VerifierBug.class Infected: Exploit.Java.ByteVerify
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN Infected: Trojan-Downloader.Java.OpenConnection.aa
C:\l2mfix\l2mfix\backup.zip/dlls/DuvX.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\l2mfix\l2mfix\backup.zip/dlls/dvcobj.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\l2mfix\l2mfix\backup.zip/dlls/dwime.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\l2mfix\l2mfix\backup.zip/dlls/e8020idoe80c0.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\l2mfix\l2mfix\backup.zip/dlls/guard.tmp Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\l2mfix\l2mfix\backup.zip/dlls/j06mlaj11do.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\l2mfix\l2mfix\backup.zip Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\SS1001.exe/data0010 Infected: Trojan-Dropper.Win32.Small.qn
C:\SS1001.exe Infected: Trojan-Dropper.Win32.Small.qn
C:\sysreset\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0131533.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132697.dll Infected: Trojan-PSW.Win32.Agent.bu
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132698.exe Infected: Trojan.Win32.Zapchast.ad
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132702.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132705.exe Infected: Trojan-Downloader.Win32.TSUpdate.l
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132708.exe Infected: Trojan-Downloader.Win32.TSUpdate.p
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132710.exe Infected: Trojan-Downloader.Win32.TSUpdate.n
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132712.exe Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe/WISE0009.BIN Infected: Trojan-Downloader.Win32.TSUpdate.n
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe/WISE0010.BIN Infected: Trojan-Downloader.Win32.TSUpdate.p
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe/WISE0011.BIN Infected: Trojan-Downloader.Win32.TSUpdate.l
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe/WISE0012.BIN Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132715.exe Infected: not-virus:Hoax.Win32.Renos.aj
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132716.exe Infected: Trojan.Win32.StartPage.agt
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132717.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132723.dll Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132724.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132729.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132732.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132802.exe/data0001 Infected: not-a-virus:AdWare.Win32.CommAd.a
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132802.exe Infected: not-a-virus:AdWare.Win32.CommAd.a
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132803.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132804.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132805.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132806.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132807.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132810.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132811.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0133139.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0133140.exe Infected: Trojan.Win32.Runner.h
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0133141.exe Infected: Trojan-Dropper.Win32.VB.kk
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133202.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133211.exe Infected: Trojan-Clicker.Win32.VB.kc
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133212.exe Infected: Trojan.Win32.StartPage.aw
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133213.dll Infected: not-a-virus:AdWare.Win32.Sud.a
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133215.exe Infected: Trojan-Downloader.Win32.Adload.l
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133259.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133339.exe Infected: Trojan-Downloader.Win32.PurityScan.ax
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133340.exe Infected: Trojan-Downloader.Win32.PassAlert.h
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133341.exe/data0006 Infected: Trojan-Dropper.Win32.VB.kk
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133341.exe Infected: Trojan-Dropper.Win32.VB.kk
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133347.exe Infected: Trojan-Downloader.Win32.PurityScan.ax
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133350.exe Infected: Trojan-Dropper.Win32.Small.qn
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133382.exe Infected: Trojan-Downloader.Win32.Adload.l
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133383.exe Infected: Trojan-Downloader.Win32.Small.bke
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133384.exe Infected: Trojan-Downloader.Win32.Qoologic.at
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133385.exe Infected: Trojan-Downloader.Win32.Small.cam
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133386.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133387.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133388.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133389.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133390.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133391.exe Infected: Trojan-Downloader.Win32.Small.buy
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133392.exe Infected: Trojan-Downloader.Win32.TSUpdate.o
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133396.dll Infected: Trojan-Clicker.Win32.Small.jf
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133397.exe Infected: Trojan-PSW.Win32.Agent.bu
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133398.exe Infected: Trojan-Downloader.Win32.Tiny.al
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133399.exe Infected: not-a-virus:AdWare.Win32.MDH.e
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133400.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133402.exe Infected: not-virus:Hoax.Win32.Renos.aj
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133403.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133406.exe Infected: Trojan-Downloader.Win32.Adload.j
C:\windows\system32\DH9013.exe/data0002 Infected: Trojan-Clicker.Win32.Small.jf
C:\windows\system32\DH9013.exe Infected: Trojan-Clicker.Win32.Small.jf
C:\WINNT\Downloaded Program Files\applet.ocx Infected: Trojan-Downloader.Win32.VB.en
C:\WINNT\system32\aqwad.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak

Scan process completed.

darishetty · 01-01-2006, 10:11 AM

6)Winpfind report:
WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 1 Current Build Number: 2600
Internet Explorer Version: 6.0.2800.1106

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...
qoologic 12/31/2005 11:42:58 PM 204131 C:\WinPFind.zip

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
web-nex 8/7/2005 9:15:18 PM 4042 C:\WINNT\mkrvn.dll

Checking %System% folder...
UPX! 12/31/2005 12:22:58 AM 41984 C:\WINNT\SYSTEM32\0wao7k9k.dll
PEC2 8/28/2002 10:00:00 PM 41397 C:\WINNT\SYSTEM32\dfrg.msc
PEC2 9/28/2005 2:29:14 PM 693248 C:\WINNT\SYSTEM32\DivX.dll
PECompact2 9/28/2005 2:29:14 PM 693248 C:\WINNT\SYSTEM32\DivX.dll
PTech 8/3/2005 9:33:42 AM 520456 C:\WINNT\SYSTEM32\LegitCheckControl.DLL
aspack 1/5/2002 1:40:18 PM 332288 C:\WINNT\SYSTEM32\msvcp70.dll
Umonitor 8/28/2002 10:00:00 PM 631808 C:\WINNT\SYSTEM32\rasdlg.dll
winsync 8/28/2002 10:00:00 PM 1309184 C:\WINNT\SYSTEM32\wbdbase.deu

Checking %System%\Drivers folder and sub-folders...

Items found in C:\WINNT\SYSTEM32\drivers\etc\Hosts
127.0.0.1 www.qoologic.com
127.0.0.1 www.urllogic.com

Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
1/1/2006 12:34:14 AM S 2048 C:\WINNT\bootstat.dat
12/28/2005 6:38:34 PM H 54156 C:\WINNT\QTFont.qfn
1/1/2006 12:34:18 AM S 64 C:\WINNT\CSC\00000001
12/31/2005 12:29:50 PM S 64 C:\WINNT\CSC\00000002
12/31/2005 7:25:22 AM S 64 C:\WINNT\CSC\csc1.tmp
1/1/2006 12:34:08 AM H 8192 C:\WINNT\system32\config\default.LOG
1/1/2006 12:34:08 AM H 8192 C:\WINNT\system32\config\SAM.LOG
1/1/2006 12:34:16 AM H 16384 C:\WINNT\system32\config\SECURITY.LOG
1/1/2006 7:27:02 AM H 294912 C:\WINNT\system32\config\software.LOG
1/1/2006 7:36:10 AM H 1155072 C:\WINNT\system32\config\system.LOG
12/31/2005 3:15:48 PM H 1024 C:\WINNT\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
12/8/2005 12

56 AM HS 388 C:\WINNT\system32\Microsoft\Protect\S-1-5-18\User\5176fc09-c0ec-4d02-885d-e9daa6c35b55
12/8/2005 12

56 AM HS 24 C:\WINNT\system32\Microsoft\Protect\S-1-5-18\User\Preferred
1/1/2006 12:32:30 AM H 6 C:\WINNT\Tasks\SA.DAT

Checking for CPL files...
Microsoft Corporation 8/28/2002 10:00:00 PM 66048 C:\WINNT\SYSTEM32\access.cpl
Microsoft Corporation 5/30/2003 3:17:20 PM 579584 C:\WINNT\SYSTEM32\appwiz.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 129024 C:\WINNT\SYSTEM32\desk.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 150016 C:\WINNT\SYSTEM32\hdwwiz.cpl
Intel Corporation 10/30/2003 1:41:28 AM 98304 C:\WINNT\SYSTEM32\igfxcpl.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 292352 C:\WINNT\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 121856 C:\WINNT\SYSTEM32\intl.cpl
Microsoft Corporation 8/17/2001 9:37:02 PM 48128 C:\WINNT\SYSTEM32\irprops.cpl
Microsoft Corporation 8/29/2002 2:41:00 AM 208896 C:\WINNT\SYSTEM32\joy.cpl
Sun Microsystems 1/15/2005 12:24:16 PM 61555 C:\WINNT\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 187904 C:\WINNT\SYSTEM32\main.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 559616 C:\WINNT\SYSTEM32\mmsys.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 35840 C:\WINNT\SYSTEM32\ncpa.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 256000 C:\WINNT\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 36864 C:\WINNT\SYSTEM32\nwc.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 36864 C:\WINNT\SYSTEM32\odbccp32.cpl
Sun Microsystems 8/8/2001 3:11:00 PM 24668 C:\WINNT\SYSTEM32\plugincpl131_01.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 109056 C:\WINNT\SYSTEM32\powercfg.cpl
Apple Computer, Inc. 1/6/2004 4:02:36 PM 323072 C:\WINNT\SYSTEM32\QuickTime.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 268288 C:\WINNT\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 28160 C:\WINNT\SYSTEM32\telephon.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 90112 C:\WINNT\SYSTEM32\timedate.cpl
Microsoft Corporation 5/26/2005 3:16:30 AM 174360 C:\WINNT\SYSTEM32\wuaucpl.cpl
The Weather Channel Interactive11/7/2005 3:49:38 PM 2980976 C:\WINNT\SYSTEM32\wxfw.cpl
Microsoft Corporation 6/27/2004 2:50:00 AM 55296 C:\WINNT\SYSTEM32\CCM\SMSCFGRC.cpl
Microsoft Corporation 6/27/2004 2:50:00 AM 13312 C:\WINNT\SYSTEM32\CCM\SMSPDM.cpl
Microsoft Corporation 6/27/2004 2:50:00 AM 55808 C:\WINNT\SYSTEM32\CCM\SMSRAP.cpl
Microsoft Corporation 6/27/2004 2:50:00 AM 233472 C:\WINNT\SYSTEM32\CCM\clicomp\RemCtrl\smsrc.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 66048 C:\WINNT\SYSTEM32\dllcache\access.cpl
Microsoft Corporation 5/30/2003 3:17:20 PM 579584 C:\WINNT\SYSTEM32\dllcache\appwiz.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 129024 C:\WINNT\SYSTEM32\dllcache\desk.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 150016 C:\WINNT\SYSTEM32\dllcache\hdwwiz.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 292352 C:\WINNT\SYSTEM32\dllcache\inetcpl.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 121856 C:\WINNT\SYSTEM32\dllcache\intl.cpl
Microsoft Corporation 8/29/2002 2:41:00 AM 208896 C:\WINNT\SYSTEM32\dllcache\joy.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 187904 C:\WINNT\SYSTEM32\dllcache\main.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 559616 C:\WINNT\SYSTEM32\dllcache\mmsys.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 35840 C:\WINNT\SYSTEM32\dllcache\ncpa.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 256000 C:\WINNT\SYSTEM32\dllcache\nusrmgr.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 36864 C:\WINNT\SYSTEM32\dllcache\nwc.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 36864 C:\WINNT\SYSTEM32\dllcache\odbccp32.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 109056 C:\WINNT\SYSTEM32\dllcache\powercfg.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 147456 C:\WINNT\SYSTEM32\dllcache\sapi.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 268288 C:\WINNT\SYSTEM32\dllcache\sysdm.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 28160 C:\WINNT\SYSTEM32\dllcache\telephon.cpl
Microsoft Corporation 8/28/2002 10:00:00 PM 90112 C:\WINNT\SYSTEM32\dllcache\timedate.cpl
Intel Corporation 4/6/2003 11:14:30 AM 94208 C:\WINNT\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxcpl.cpl
Intel Corporation 4/6/2003 11:14:30 AM 94208 C:\WINNT\SYSTEM32\ReinstallBackups\0002\DriverFiles\igfxcpl.cpl
Intel Corporation 10/30/2003 1:41:28 AM 98304 C:\WINNT\SYSTEM32\ReinstallBackups\0007\DriverFiles\igfxcpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
12/15/2003 12:05:56 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
3/10/2005 2:00:08 PM 1749 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DOG_CONFIG UTILITY.LNK
12/15/2003 12:41:42 PM 1731 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
12/31/2005 11:58:30 PM 228352 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\oiwq.exe

Checking files in %ALLUSERSPROFILE%\Application Data folder...
12/15/2003 4:51:06 AM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini

Checking files in %USERPROFILE%\Startup folder...
12/15/2003 12:05:56 PM HS 84 C:\Documents and Settings\ddarish\Start Menu\Programs\Startup\desktop.ini

Checking files in %USERPROFILE%\Application Data folder...
12/15/2003 4:51:06 AM HS 62 C:\Documents and Settings\ddarish\Application Data\desktop.ini

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
SV1 =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido anti-malware\context.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\LDVPMenu
{BDA77241-42F6-11d0-85E2-00AA001FE28C} = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\mqskyfmy
{7df3f00a-e833-4db7-838a-3c71a275b24c} = C:\WINNT\System32\klqkm.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
=
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Yahoo! Mail
{5464D816-CF16-4784-B9F3-75C0DB52B499} = C:\PROGRA~1\Yahoo!\Common\ymmapi.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Adware.Remover.Gold
{DD5B27C9-B44C-4418-8562-6CADA5708321} =
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\LDVPMenu
{BDA77241-42F6-11d0-85E2-00AA001FE28C} = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR
=

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido anti-malware\context.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR
=

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}
=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\system32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
Real.com = C:\WINNT\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping
MenuText = :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
MenuText = Sun Java Console : C:\WINNT\System32\msjava.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}
ButtonText = Spyware Doctor :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{669B269B-0D4E-41FB-A3D8-FD67CA94F646}
ButtonText = ComcastHSI : http://www.comcast.net/
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8828075D-D097-4055-AA02-2DBFA9D85E8A}
ButtonText = Support : http://www.comcastsupport.com/
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{97809617-3937-4F84-B335-9BB05EF1A8D4}
ButtonText = Help : http://online.comcast.net/help/
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
ButtonText = Real.com :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}
ButtonText = Yahoo! Messenger : C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = @C:\Program Files\Messenger\Msgslang.dll,-61144 : C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
Media Band = %SystemRoot%\system32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
Favorites Band = %SystemRoot%\system32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer Band = %SystemRoot%\system32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\system32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\system32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar1.dll
{5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} = JunoBar : C:\Program Files\Juno\toolbar.dll
{F0F8ECBE-D460-4B34-B007-56A92E8F84A7} = :
{4982D40A-C53B-4615-B15B-B5B5E98D167C} = :
{EF99BD32-C1FB-11D2-892F-0090271D4F88} = Yahoo! Toolbar :

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
vptray C:\Program Files\NavNT\vptray.exe
IgfxTray C:\WINNT\System32\igfxtray.exe
HotKeysCmds C:\WINNT\System32\hkcmd.exe
SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
BlazentEnvironmentVariableCollector C:\Program Files\Blazent\BlazentAgent\bin\BZEnvironmentVariableCollector.exe
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
SunJavaUpdateSched C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
tgcmd "C:\Program Files\support.com\bin\tgcmd.exe" /server
winsync C:\WINNT\System32\pkqoaw.exe reg_run

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe C:\WINNT\System32\ctfmon.exe
DW4 "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
Yahoo! Pager C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoMSAppLogo5ChannelNotify 1
NoToolbarCustomize 0
NoBandCustomize 0
NoWelcomeScreen 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 1
shutdownwithoutlogon 1
undockwithoutlogon 1
RunLogonScriptSync 1
LegalNoticeCaption
LegalNoticeText

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop
NoClosingComponents 0
NoCloseDragDropBands 0
NoMovingBands 0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145
NoActiveDesktop 1
NoFavoritesMenu 0
NoFind 0
NoRun 0
NoChangeStartMenu 0
NoFolderOptions 0
NoRecentDocsMenu 0
NoRecentDocsHistory 0
ClearRecentDocsOnExit 0
NoLogoff 0
NoClose 0
NoSetFolders 0
NoSetTaskbar 0
NoTrayContextMenu 0
NoFileMenu 0
NoViewContextMenu 0
EnforceShellExtensionSecurity 0
LinkResolveIgnoreLinkInfo 0
NoDrives 0
NoNetConnectDisconnect 0
NoDeletePrinter 0
NoPrinterTabs 0
Btn_Back 0
Btn_Forward 0
Btn_Stop 0
Btn_Refresh 0
Btn_Home 0
Btn_Search 0
Btn_History 0
Btn_Favorites 0
Btn_Media 0
Btn_Folders 0
Btn_Fullscreen 0
Btn_Tools 0
Btn_MailNews 0
Btn_Size 0
Btn_Print 0
Btn_Edit 0
Btn_Discussions 0
Btn_Cut 0
Btn_Copy 0
Btn_Paste 0
Btn_Encoding 0
Btn_PrintPreview 0
NoDesktopCleanupWizard 1
ClassicShell 0
ForceActiveDesktopOn 0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
nlelcsxrv.exe C:\WINNT\system\nlelcsxrv.exe

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{20D04FE0-3AEA-1069-A2D8-08002B30309D} = %SystemRoot%\system32\SHELL32.dll

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
DisableRegistryTools 0
RunLogonScriptSync 1

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WinOldApp
NoRealMode 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\system32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINNT\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,
Shell = Explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui
= igfxsrvc.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon
= C:\WINNT\System32\NavLogon.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs

»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 1/1/2006 7:44:36 AM

Thanks,
dd

sUBs · 01-01-2006, 11:13 AM

There's something erronous about the logs you have just posted. May I ask if you tried running Ewido from Normal Mode?

Let's try it again...

Please use Symantec's guide to remove the quarantine files.

Please download the file attached - regdel.zip
Save it on your desktop. We shall be needing it in Safe Mode

* * * * * * KILLBOX * * * * * * * * * * * * * * * * * * * * * * *

Launch KillBox.exe & select the following options:

delete on Reboot

All files (if available)

Use your mouse to select all the filenames listed below & then right-click & select Copy

C:\AGEU_SilentSudokuInstaller.exe
C:\l2mfix\l2mfix\backup.zip
C:\SS1001.exe
C:\windows\system32\DH9013.exe
C:\WINNT\Downloaded Program Files\applet.ocx
C:\WINNT\system32\aqwad.dll
C:\WINNT\system\nlelcsxrv.exe
C:\WINNT\System32\klqkm.dll
C:\WINNT\mkrvn.dll
C:\WINNT\SYSTEM32\0wao7k9k.dll
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\oiwq.exe
C:\Documents and Settings\ddarish\Start Menu\Programs\Startup\oiwq.exe

* Go to the File menu, and choose Paste from Clipboard
* Click the RED X button.
* Click Yes at the Delete on Reboot prompt.
* Click Yes at the 'Pending Operations prompt'.

* * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * *

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the option to run Windows in Safe Mode.

* * * * * * BATCHES / REG FIXES * * * * * * * * * * * * * * * * *

From within regdel.zip, doubleclick regdel.reg & allow it to merge with the Registry
This will remove some malware entries from the Registry

* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * *

Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider initially to Standard CleanUp!
3. Uncheck the following:

Delete Newsgroup cache
Delete Newsgroup Subscriptions
Scan local drives for temporary files

4. Click OK
5. Press the CleanUp! button to start the program.
6. Do NOT reboot/logoff if prompted.

* * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * *

Run Ewido again:(...it's important that all windows must be closed)

Click Scanner
Click Complete System Scan to begin scanning.
Click OK when prompted to clean files

With the first file it prompts to clean, select the option:

"Perform action on all infections"
.Choose clean and click OK.

Once finished, click the Save report button & save the report to your desktop

* * * * * * DEEP SCAN * * * * * * * * * * * * * * * * * * * *

1. From within the WinPFind folder, double click WinPFind.exe
2. Click Start Scan
3. Once the Scan is complete, it will create a report in a text file
4. Go to the WinPFind folder & locate WinPFind.txt
5. Post the results in your next reply!

** This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

* * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * *

Perform an online scan with Internet Explorer with Panda ActiveScan

Click Scan your PC & a 'pop up' window shall appear. *ensure that your pop up blocker doesn't block it
Click Scan Now
Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls

Begin the scan by selecting My Computer

If it finds any malware, it will offer you a report.
Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
Click on see report. Then click Save report

Post the contents of the report in your next reply

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan

* * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * *

In your next post, please include fresh logs from:

HiJackThis log

Online Scan

Ewido

WinPfind

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

darishetty · 01-01-2006, 03:46 PM

What is removing quarantine files and why and how it can be performed?

Thanks..

sUBs · 01-01-2006, 11:50 PM

Quote:

Originally Posted by darishetty

What is removing quarantine files and why and how it can be performed?

Have you not read Symantec's guide yet?
http://service1.symantec.com/SUPPORT...on=1#_Section1

12-31-2005, 10:37 AM	#1 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	Help with spyware-hijackthis log Hi all, my computer is infected with spyware. Can any one of you help me in getting rid of this? Here is Hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 10:18:38 AM, on 12/31/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\ISS\issSensors\DesktopProtection\blackd.exe C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe C:\Program Files\NavNT\defwatch.exe c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\NavNT\rtvscan.exe C:\Program Files\Blazent\BlazentAgent\bin\BZController.exe C:\WINNT\System32\Qinst.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINNT\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\CCM\CcmExec.exe C:\WINNT\System32\MsgSys.EXE C:\Program Files\Citrix\ICA Client\ssonsvr.exe C:\WINNT\Explorer.EXE C:\Program Files\NavNT\vptray.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe C:\Program Files\support.com\bin\tgcmd.exe C:\WINNT\System32\RUNDLL32.EXE C:\windows\adtech2006a.exe C:\WINNT\System32\igps.exe C:\WINNT\System32\pgws.exe C:\WINNT\System32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\VCClient\VCClient.exe C:\Program Files\Common Files\VCClient\VCMain.exe C:\Program Files\ccrb\tere.exe C:\WINNT\SYSTEM32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ddarish\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://theq.qwest.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\Program Files\QL\qlink32.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1 O4 - HKLM\..\Run: [BlazentEnvironmentVariableCollector] C:\Program Files\Blazent\BlazentAgent\bin\BZEnvironmentVariableCollector.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe O4 - HKLM\..\Run: [0wao0o9s.dll] RUNDLL32.EXE 0wao0o9s.dll,b 106225644 O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe O4 - HKLM\..\Run: [lspins] "C:\WINNT\System32\igps.exe" O4 - HKLM\..\Run: [winsync] C:\WINNT\System32\pkqoaw.exe reg_run O4 - HKLM\..\Run: [hgqhp.exe] C:\WINNT\System32\hgqhp.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - HKCU\..\Run: [Pase] "C:\Program Files\ccrb\tere.exe" -vt yazr O4 - HKCU\..\Run: [Ypwiyhh] C:\WINNT\System32\??crosoft.NET\mshta.exe O4 - Global Startup: DOG_CONFIG UTILITY.LNK = C:\Program Files\Qwest Browsers\ConfigLauncher.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing) O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing) O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://theq.qwest.net O15 - Trusted Zone: http://*.qtomaacmw01 O15 - Trusted Zone: http://deskopweb.qwest.net O15 - Trusted Zone: http://doweb.qwest.net O15 - Trusted Zone: http://theq.qwest.net O16 - DPF: {11B2C0D3-DFFB-11D3-9253-00500498D7E5} - O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/1223079d...p/RdxIE601.cab O16 - DPF: {6DA10734-25FD-4350-A8FF-B5A6DBB49680} (WAFUploader Class) - https://www.web-a-file.com/webafileuploader.cab O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - http://203.199.42.226/Media/visitorchat/TLIEFlash.CAB O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) - http://imlive.com/ChatSource/gVideoContol.cab O16 - DPF: {BADA82CB-BF48-4D76-9611-78E2C6F49F03} (BolDownloader Control) - http://messenger.rediff.com/newbol/Bol.CAB O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AD.QINTRA.COM O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = uswc.uswest.com O17 - HKLM\Software\..\Telephony: DomainName = AD.QINTRA.COM O17 - HKLM\System\CCS\Services\Tcpip\..\{0BC9ECE2-073B-476C-8109-010D10D2A472}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: Domain = AD.QINTRA.COM O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{2B212F05-A9A5-475F-BBBC-07042B203A05}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{3CF58A82-4251-49B6-BAD5-8B68D12CF5DF}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE72614-EAC2-4966-91FF-D35171095447}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{CA2E7D92-348D-4C6C-AD08-452A5671B942}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{DB973A40-52DE-4BA9-A5C5-852F43434744}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{F2F9F882-346D-48BA-AC04-C68D0C26546A}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = uswc.uswest.com,qwest.net,qintra.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ad.qintra.com,qintra.com,uswc.uswest.com,qwest.net,lci.com O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\Program Files\QL\qlink32.dll O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll O20 - Winlogon Notify: Setup - C:\WINNT\system32\j06mlaj11do.dll O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\blackd.exe O23 - Service: Blazent Agent - Blazent, Inc. - C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: EXE_CRON - - c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe O23 - Service: Qinst - Unknown owner - C:\WINNT\System32\Qinst.exe O23 - Service: RapApp - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\RapApp.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe Thanks in advance. ..dd

12-31-2005, 11:01 AM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,489 OS: N/A	Please do the following: Download & immediately run - L2MFix.exe Click "Install" to extract the contents to a newly created folder. Close any programs you have open since this step requires a reboot. From the l2mfix folder, double click l2mfix.bat Select option #2 for Run Fix by typing 2 and then pressing enter ONCE. Do NOT depress any keys on your keyboard until the tool request you to "press any key to reboot" On the reboot notepad will open with a log. Copy/paste the contents of that log back into this thread, along with a new hijackthis log. IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so! If after the reboot the log does not open double click on it in the l2mfix folder to locate log.txt. If you receive an error - \system32\Autoexec.nt is not suitable for running MS-Dos applications, you will need to visit this website to download additional files. __________________ Question - what have you done for the community today?

12-31-2005, 12:35 PM	#3 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	L2mfix log file: Thanks Sub for quick response. Here are contents of L2mfix: L2mfix Beta 122705 Creating Account. The command completed successfully. Adding Administrative privleges. The command completed successfully. Checking for L2MFix account(0=no 1=yes): 1 Granting SeDebugPrivilege to L2MFIX ... successful Running From: C:\WINNT\SYSTEM32 Killing Processes! Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 332 'smss.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 404 'winlogon.exe' Killing PID 404 'winlogon.exe' Killing PID 404 'winlogon.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 2352 'explorer.exe' Killing PID 2352 'explorer.exe' Killing PID 2352 'explorer.exe' Killing PID 2352 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 2728 'rundll32.exe' Killing PID 3860 'rundll32.exe' Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrators ... successful Scanning First Pass. Please Wait! First Pass Completed Second Pass Scanning Second pass Completed! moving: C:\WINNT\system32\DuvX.dll Successfully Moved: C:\WINNT\system32\DuvX.dll moving: C:\WINNT\system32\dvcobj.dll Successfully Moved: C:\WINNT\system32\dvcobj.dll moving: C:\WINNT\system32\dwime.dll Successfully Moved: C:\WINNT\system32\dwime.dll moving: C:\WINNT\system32\e8020idoe80c0.dll Successfully Moved: C:\WINNT\system32\e8020idoe80c0.dll moving: C:\WINNT\system32\j06mlaj11do.dll Successfully Moved: C:\WINNT\system32\j06mlaj11do.dll moving: C:\WINNT\system32\guard.tmp Successfully Moved: C:\WINNT\system32\guard.tmp Restoring Windows Update Certificates.: The following Is the Current Export of the Winlogon notify key: ************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] "DllName"="C:\\WINNT\\System32\\NavLogon.dll" "Logoff"="NavLogoffEvent" "StartShell"="NavStartShellEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Setup] "Asynchronous"=dword:00000000 "DllName"="C:\\WINNT\\system32\\j06mlaj11do.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 The following are the files found: ************************************************************************ C:\WINNT\system32\DuvX.dll C:\WINNT\system32\dvcobj.dll C:\WINNT\system32\dwime.dll C:\WINNT\system32\e8020idoe80c0.dll C:\WINNT\system32\j06mlaj11do.dll C:\WINNT\system32\guard.tmp Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. ************************************************************************ Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}] @="" [HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}\InprocServer32] @="C:\\WINNT\\system32\\DuvX.dll" "ThreadingModel"="Apartment" REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}"=- [-HKEY_CLASSES_ROOT\CLSID\{91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1}] REGEDIT4 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" ************************************************************************ Desktop.ini Contents: ************************************************************************ ************************************************************************** Checking for L2MFix account(0=no 1=yes): 0 Zipping up files for submission: adding: dlls/DuvX.dll (148 bytes security) (deflated 5%) adding: dlls/dvcobj.dll (148 bytes security) (deflated 5%) adding: dlls/dwime.dll (148 bytes security) (deflated 5%) adding: dlls/e8020idoe80c0.dll (148 bytes security) (deflated 5%) adding: dlls/guard.tmp (148 bytes security) (deflated 5%) adding: dlls/j06mlaj11do.dll (148 bytes security) (deflated 5%) adding: backregs/91129F1F-9EAE-4763-9B9F-40A6EFBF1EA1.reg (212 bytes security) (deflated 70%) adding: backregs/notibac.reg (188 bytes security) (deflated 88%) adding: backregs/shell.reg (188 bytes security) (deflated 73%) Thanks once again.

12-31-2005, 12:38 PM	#4 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	Hijack this log Hi, Here is the latest Hijackthis log file: Logfile of HijackThis v1.99.1 Scan saved at 12:38:18 PM, on 12/31/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\ISS\issSensors\DesktopProtection\blackd.exe C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe C:\Program Files\NavNT\defwatch.exe c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\NavNT\rtvscan.exe C:\WINNT\System32\Qinst.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINNT\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\CCM\CcmExec.exe C:\Program Files\Citrix\ICA Client\ssonsvr.exe C:\WINNT\System32\msiexec.exe C:\WINNT\System32\MsgSys.EXE C:\WINNT\Explorer.EXE C:\Program Files\Blazent\BlazentAgent\bin\BZController.exe C:\Program Files\NavNT\vptray.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe C:\Program Files\support.com\bin\tgcmd.exe C:\WINNT\System32\RUNDLL32.EXE C:\windows\adtech2006a.exe C:\WINNT\System32\igps.exe C:\WINNT\System32\pgws.exe C:\WINNT\System32\ctfmon.exe C:\Program Files\Common Files\VCClient\VCClient.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\VCClient\VCMain.exe C:\Program Files\ccrb\tere.exe C:\WINNT\System32\??crosoft.NET\mshta.exe C:\navupdate\WiseUpdt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Blazent\BlazentAgent\bin\BZSoftwareInventoryCollector.exe C:\Documents and Settings\ddarish\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://theq.qwest.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\Program Files\QL\qlink32.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1 O4 - HKLM\..\Run: [BlazentEnvironmentVariableCollector] C:\Program Files\Blazent\BlazentAgent\bin\BZEnvironmentVariableCollector.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe O4 - HKLM\..\Run: [0wao0o9s.dll] RUNDLL32.EXE 0wao0o9s.dll,b 106225644 O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe O4 - HKLM\..\Run: [lspins] "C:\WINNT\System32\igps.exe" O4 - HKLM\..\Run: [winsync] C:\WINNT\System32\pkqoaw.exe reg_run O4 - HKLM\..\Run: [yaemu.exe] C:\WINNT\System32\yaemu.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - HKCU\..\Run: [Pase] "C:\Program Files\ccrb\tere.exe" -vt yazr O4 - HKCU\..\Run: [Ypwiyhh] C:\WINNT\System32\??crosoft.NET\mshta.exe O4 - Global Startup: DOG_CONFIG UTILITY.LNK = C:\Program Files\Qwest Browsers\ConfigLauncher.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing) O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing) O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://theq.qwest.net O15 - Trusted Zone: http://.qtomaacmw01 O15 - Trusted Zone: http://deskopweb.qwest.net O15 - Trusted Zone: http://doweb.qwest.net O15 - Trusted Zone: http://theq.qwest.net O15 - Trusted Zone: http://.sdg O16 - DPF: {11B2C0D3-DFFB-11D3-9253-00500498D7E5} - O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/1223079d...p/RdxIE601.cab O16 - DPF: {6DA10734-25FD-4350-A8FF-B5A6DBB49680} (WAFUploader Class) - https://www.web-a-file.com/webafileuploader.cab O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - http://203.199.42.226/Media/visitorchat/TLIEFlash.CAB O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) - http://imlive.com/ChatSource/gVideoContol.cab O16 - DPF: {BADA82CB-BF48-4D76-9611-78E2C6F49F03} (BolDownloader Control) - http://messenger.rediff.com/newbol/Bol.CAB O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AD.QINTRA.COM O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = uswc.uswest.com O17 - HKLM\Software\..\Telephony: DomainName = AD.QINTRA.COM O17 - HKLM\System\CCS\Services\Tcpip\..\{0BC9ECE2-073B-476C-8109-010D10D2A472}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: Domain = AD.QINTRA.COM O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{2B212F05-A9A5-475F-BBBC-07042B203A05}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{3CF58A82-4251-49B6-BAD5-8B68D12CF5DF}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE72614-EAC2-4966-91FF-D35171095447}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{CA2E7D92-348D-4C6C-AD08-452A5671B942}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{DB973A40-52DE-4BA9-A5C5-852F43434744}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{F2F9F882-346D-48BA-AC04-C68D0C26546A}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = uswc.uswest.com,qwest.net,qintra.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ad.qintra.com,qintra.com,uswc.uswest.com,qwest.net,lci.com O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\Program Files\QL\qlink32.dll O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll O20 - Winlogon Notify: Setup - C:\WINNT\system32\j06mlaj11do.dll (file missing) O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\blackd.exe O23 - Service: Blazent Agent - Blazent, Inc. - C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: EXE_CRON - - c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe O23 - Service: Qinst - Unknown owner - C:\WINNT\System32\Qinst.exe O23 - Service: RapApp - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\RapApp.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe Thanks, dd

12-31-2005, 12:40 PM	#5 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,489 OS: N/A	I would also like a copy of your uninstall list. You may obtain one by doing so.. Start HJT & goto Config > Misc Tools - Open Uninstall Manager Click the Save List button & post the the resultant log. Please highlight any entries that looks suspicious to you __________________ Question - what have you done for the community today?

12-31-2005, 12:46 PM	#6 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	uninstall_lst log .NET Certficate Authority Browser Patch - Pkg #1054 Ad-Aware SE Personal Adobe Reader 6.0.1 Agere Systems AC'97 Modem Blazent Agent Broadcom 440x 10/100 Integrated Controller CentraOne Citrix Program Neighborhood ComcastSUPPORT Desktop Weather by The Weather Channel DH DirectX 9 Hotfix - KB839643 DivX DivX Player ELSA Configuration Manager Faxcom for SMTP Client Google Toolbar for Internet Explorer HighMAT Extension to Microsoft Windows XP CD Writing Wizard HijackThis 1.99.1 IBM Integrated 56K Modem Intel(R) Extreme Graphics 2 Driver Intel(R) PRO Ethernet Adapter and Software Java 2 Runtime Environment Standard Edition v1.3.1_01 Java 2 Runtime Environment, SE v1.4.2_01 Java 2 Runtime Environment, SE v1.4.2_07 Java 2 SDK, SE v1.4.2_01 LiveUpdate 1.7 (Symantec Corporation) Macromedia Flash Player 8 MetaFrame Presentation Server Client Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft Chat 2.5 Microsoft Data Access Components KB870669 Microsoft Office Converter Pack Microsoft Office XP Professional Microsoft Office XP Web Components Microsoft Outlook 2002 Microsoft Visio Viewer 2002 Mozilla Firefox (1.5) MSN Messenger 7.5 NAV.7.61.x.2003.F Norton AntiVirus Corporate Edition Outlook Express Q823353 PC Camera PC Camera (6025 VGA) QuicklinksQuickTime RealPlayer Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905495) Security Update for Windows XP (KB905749) SoundMAX Spybot - Search & Destroy 1.4 Spyware Doctor 3.2 Sun Java 2 Runtime Environment Synaptics Pointing Device Driver TaxACT 2005 Texas Instruments PCIxx20 drivers. USB 2.0 Image Wall Data Software Weather Services Winamp (remove only) Windows Media Player 9 Series Windows Messenger 5.0 Windows XP Hotfix - KB824151 Windows XP Hotfix - KB828028 Windows XP Hotfix - KB833987 Windows XP Hotfix - KB834707 Windows XP Hotfix - KB839643 Windows XP Hotfix - KB839645 Windows XP Hotfix - KB840315 Windows XP Hotfix - KB840374 Windows XP Hotfix - KB840987 Windows XP Hotfix - KB841356 Windows XP Hotfix - KB841533 Windows XP Hotfix - KB841873 Windows XP Hotfix - KB842773 Windows XP Hotfix - KB867282 Windows XP Hotfix - KB871250 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB873376 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB889293 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891711 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB892944 Windows XP Hotfix - KB893086 Windows XP Hotfix - KB896688 Yahoo! Internet Mail Yahoo! Messenger Yazzle Sudoku by OIN Last edited by darishetty; 12-31-2005 at 12:56 PM.

12-31-2005, 12:54 PM	#7 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,489 OS: N/A	Please uninstall these programs: Yazzle Sudoku by OIN Quicklinks Start HJT & goto Config > Misc Tools - Open Uninstall Manager From the box on the left, select each entry & look up the the uninstall command from the right : DH Please let me know each entry's uninstall command Please visit this website - http://virusscan.jotti.org Submit these files for a comprehensive scan & then post the results back here. c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron. exe C:\WINNT\System32\Qinst.exe __________________ Question - what have you done for the community today?

12-31-2005, 01:02 PM	#8 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	When I am trying to upload the file "C:\WINNT\DHU.exe" I am getting following error: "The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file."

12-31-2005, 01:05 PM	#9 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	For C:\WINNT\System32\Qinst.exe: I got following report: Service load: 0% 100% File: Qinst.exe_ Status: OK MD5 4f9c6afec4d35d8d4f78555cc84e5e61 Packers detected: - Scanner results AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing UNA Found nothing VBA32 Found nothing

12-31-2005, 01:06 PM	#10 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	For c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron. exe I am getting error: The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

12-31-2005, 01:06 PM	#11 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,489 OS: N/A	Ermm..where did you get C:\WINNT\DHU.exe from? Is it from the uninstall command for the program -DH ? I only requested for these to be scanned at jotti: c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron. exe C:\WINNT\System32\Qinst.exe __________________ Question - what have you done for the community today?

12-31-2005, 01:12 PM	#12 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	Uninstall command for the program DH is C:\WINNT\DHU.exe. For c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron. exe I am getting error: "The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file" Thanks

12-31-2005, 01:14 PM	#13 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,489 OS: N/A	Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. * * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * * Download & install CleanUp.exe (not recommended for WinXP64) Download KillBox v2.0.0.175.exe (it's important that you get version v2.0.0.175) WinPfind.zip - download & extract the contents to it's own folder at the root of drive C TrackQoo.zip Download and install Ewido Security Suite When installing, under "Additional Options", uncheck - Install background guard Have Ewido update itself & then exit the program. If you are having problems with the updater, you can use this link to manually update Ewido Please download & Install - FixWareout.exe When you reach the final page of the installation process, make sure "Run fixit" is checked. Follow the on-screen prompts & reboot your computer when instructed to do so. *Do not be alarmed if your computer takes longer than usual to load. After you have restarted, wait for HijackThis to launch automatically. With HiJackThis & place a check next to these items and select "Fix checked": R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\Program Files\QL\qlink32.dll O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1 O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe O4 - HKLM\..\Run: [0wao0o9s.dll] RUNDLL32.EXE 0wao0o9s.dll,b 106225644 O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe O4 - HKLM\..\Run: [lspins] "C:\WINNT\System32\igps.exe" O4 - HKLM\..\Run: [winsync] C:\WINNT\System32\pkqoaw.exe reg_run O4 - HKLM\..\Run: [yaemu.exe] C:\WINNT\System32\yaemu.exe O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - HKCU\..\Run: [Pase] "C:\Program Files\ccrb\tere.exe" -vt yazr O4 - HKCU\..\Run: [Ypwiyhh] C:\WINNT\System32\??crosoft.NET\mshta.exe O16 - DPF: {11B2C0D3-DFFB-11D3-9253-00500498D7E5} - O17 - HKLM\System\CCS\Services\Tcpip\..\{0BC9ECE2-073B-476C-8109-010D10D2A472}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{2B212F05-A9A5-475F-BBBC-07042B203A05}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{3CF58A82-4251-49B6-BAD5-8B68D12CF5DF}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE72614-EAC2-4966-91FF-D35171095447}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{CA2E7D92-348D-4C6C-AD08-452A5671B942}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{DB973A40-52DE-4BA9-A5C5-852F43434744}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{F2F9F882-346D-48BA-AC04-C68D0C26546A}: NameServer = 85.255.116.104,85.255.112.213 O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\Program Files\QL\qlink32.dll O20 - Winlogon Notify: Setup - C:\WINNT\system32\j06mlaj11do.dll (file missing) Close HijackThis, and click OK to proceed. FixWareOut will produce a logfile, report.txt located within the C:\fixwareout folder * * * * * KILLBOX * * * * * * * * * * * * * * * * * * * * * * * Launch KillBox.exe & select the following options: delete on Reboot All files (if available) Use your mouse to select all the filenames listed below & then right-click & select Copy C:\windows\adtech2006a.exe C:\WINNT\System32\igps.exe C:\WINNT\System32\pgws.exe C:\windows\timessquare.exe C:\WINNT\System32\0wao0o9s.dll C:\WINNT\DHU.exe c:\drsmartloadb.exe C:\WINNT\System32\pkqoaw.exe C:\WINNT\System32\yaemu.exe * Go to the File menu, and choose Paste from Clipboard * Click the RED X button. * Click Yes at the Delete on Reboot prompt. * Click Yes at the 'Pending Operations prompt'. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, download and run missingfilesetup.exe. Then try Killbox again. * * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * * If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools -> Folder Options -> View tab. Tick - 'Show hidden files and folder' Untick - 'Hide file extensions for known types' Untick - 'Hide protected operating system files' Click Yes to confirm & then click OK Locate and delete the following files/folders: (let me know if you fail to find/delete any) C:\Program Files\QL\ C:\PROGRA~1\BUTTER~1\ C:\Program Files\Common Files\VCClient\ C:\Program Files\ccrb\ C:\WINNT\System32\??crosoft.NET\ * * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following: Delete Newsgroup cache Delete Newsgroup Subscriptions Scan local drives for temporary files 4. Click OK 5. Press the CleanUp! button to start the program. 6. Do NOT reboot/logoff if prompted. * CleanUp! will not create any backups!! * * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * * Run Ewido with it's updated definitions:(...it's important that all windows must be closed) Click Scanner Click Complete System Scan to begin scanning. Click OK when prompted to clean files With the first file it prompts to clean, select the option: "Perform action on all infections" .Choose clean and click OK. Once finished, click the Save report button & save the report to your desktop ** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete. * * * * * * DEEP SCAN * * * * * * * * * * * * * * * * * * * * 1. From within the WinPFind folder, double click WinPFind.exe 2. Click Start Scan 3. Once the Scan is complete, it will create a report in a text file 4. Go to the WinPFind folder & locate WinPFind.txt 5. Post the results in your next reply! ** This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more. * * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * * Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan From within TrackQoo.zip, double-click on TrackQoo1.vbs. Wait a few seconds and a notepad page will pop up, Copy & Paste those results in your next reply. * If your Antivirus has Script Blocking, you will get a Pop Up Windows asking you what to do. Allow this Entire Script to Run, its harmless! * * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh logs from: FixWareout's log HiJackThis log Online Scan WinPfind TrackQoo Ewido Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Question - what have you done for the community today?

01-01-2006, 10:06 AM	#14 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	Final logs Here are final logs: 1) Fixwareour log: Fixwareout ver 1.003 Last edited 12/5/2005 Post this report in the forums please Reg Entries that were deleted PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Search by size and names... »»»»» Misc files »»»»» Checking for older varients covered by the Rem3 tool 2)Hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 9:52:37 AM, on 1/1/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\ISS\issSensors\DesktopProtection\blackd.exe C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe C:\Program Files\NavNT\defwatch.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Blazent\BlazentAgent\bin\BZController.exe c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\NavNT\rtvscan.exe C:\Program Files\Citrix\ICA Client\ssonsvr.exe C:\WINNT\System32\Qinst.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\CCM\CcmExec.exe C:\WINNT\System32\MsgSys.EXE C:\Program Files\NavNT\vptray.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe C:\Program Files\support.com\bin\tgcmd.exe C:\WINNT\System32\ctfmon.exe C:\WINNT\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ddarish\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [BlazentEnvironmentVariableCollector] C:\Program Files\Blazent\BlazentAgent\bin\BZEnvironmentVariableCollector.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server O4 - HKLM\..\Run: [winsync] C:\WINNT\System32\pkqoaw.exe reg_run O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - Global Startup: DOG_CONFIG UTILITY.LNK = C:\Program Files\Qwest Browsers\ConfigLauncher.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing) O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing) O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://theq.qwest.net O15 - Trusted Zone: http://.qtomaacmw01 O15 - Trusted Zone: http://deskopweb.qwest.net O15 - Trusted Zone: http://doweb.qwest.net O15 - Trusted Zone: http://theq.qwest.net O15 - Trusted Zone: http://.sdg O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/1223079d...p/RdxIE601.cab O16 - DPF: {6DA10734-25FD-4350-A8FF-B5A6DBB49680} (WAFUploader Class) - https://www.web-a-file.com/webafileuploader.cab O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - http://203.199.42.226/Media/visitorchat/TLIEFlash.CAB O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) - http://imlive.com/ChatSource/gVideoContol.cab O16 - DPF: {BADA82CB-BF48-4D76-9611-78E2C6F49F03} (BolDownloader Control) - http://messenger.rediff.com/newbol/Bol.CAB O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AD.QINTRA.COM O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = uswc.uswest.com O17 - HKLM\Software\..\Telephony: DomainName = AD.QINTRA.COM O17 - HKLM\System\CCS\Services\Tcpip\..\{208D00D5-E6AB-449F-A5A2-775200325960}: NameServer = 85.255.116.104,85.255.112.213 O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = uswc.uswest.com,qwest.net,qintra.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ad.qintra.com,qintra.com,uswc.uswest.com,qwest.net,lci.com O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\blackd.exe O23 - Service: Blazent Agent - Blazent, Inc. - C:\Program Files\Blazent\BlazentAgent\bin\BZICU.exe O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: EXE_CRON - - c:\winnt\micros~1.net\framew~1\v11~1.432\exe_cron.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe O23 - Service: Qinst - Unknown owner - C:\WINNT\System32\Qinst.exe O23 - Service: RapApp - Internet Security Systems, Inc. - C:\ISS\issSensors\DesktopProtection\RapApp.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 3)Trackqoo log REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "vptray"="C:\\Program Files\\NavNT\\vptray.exe" "IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "BlazentEnvironmentVariableCollector"="C:\\Program Files\\Blazent\\BlazentAgent\\bin\\BZEnvironmentVariableCollector.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_07\\bin\\jusched.exe" "tgcmd"="\"C:\\Program Files\\support.com\\bin\\tgcmd.exe\" /server" "winsync"="C:\\WINNT\\System32\\pkqoaw.exe reg_run" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" ----------------- HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers Subkey --- ewido {57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} C:\Program Files\ewido anti-malware\context.dll Subkey --- LDVPMenu {BDA77241-42F6-11d0-85E2-00AA001FE28C} C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll Subkey --- mqskyfmy {7df3f00a-e833-4db7-838a-3c71a275b24c} C:\WINNT\System32\klqkm.dll Subkey --- Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} C:\WINNT\System32\cscui.dll Subkey --- Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} C:\WINNT\system32\SHELL32.dll Subkey --- Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} C:\WINNT\system32\SHELL32.dll Subkey --- WinRAR Subkey --- Yahoo! Mail {5464D816-CF16-4784-B9F3-75C0DB52B499} C:\PROGRA~1\Yahoo!\Common\ymmapi.dll Subkey --- {a2a9545d-a0c2-42b4-9708-a0b2badd77c8} Start Menu Pin C:\WINNT\system32\SHELL32.dll ===================== HKEY_CLASSES_ROOT\Folder\shellex\ColumnHandlers Subkey --- {0D2E74C4-3C34-11d2-A27E-00C04FC30871} C:\WINNT\system32\SHELL32.dll Subkey --- {24F14F01-7B1C-11d1-838f-0000F80461CF} C:\WINNT\system32\SHELL32.dll Subkey --- {24F14F02-7B1C-11d1-838f-0000F80461CF} C:\WINNT\system32\SHELL32.dll Subkey --- {66742402-F9B9-11D1-A202-0000F81FEDEE} C:\WINNT\system32\SHELL32.dll ============================== C:\Documents and Settings\All Users\Start Menu\Programs\Startup desktop.ini DOG_CONFIG UTILITY.LNK Microsoft Office.lnk oiwq.exe ============================== C:\Documents and Settings\ddarish\Start Menu\Programs\Startup desktop.ini DOG_CONFIG UTILITY.LNK Microsoft Office.lnk oiwq.exe desktop.ini ============================== C:\WINNT\system32 cpl files access.cpl Microsoft Corporation appwiz.cpl Microsoft Corporation desk.cpl Microsoft Corporation hdwwiz.cpl Microsoft Corporation igfxcpl.cpl Intel Corporation inetcpl.cpl Microsoft Corporation intl.cpl Microsoft Corporation irprops.cpl Microsoft Corporation joy.cpl Microsoft Corporation jpicpl32.cpl Sun Microsystems main.cpl Microsoft Corporation mmsys.cpl Microsoft Corporation ncpa.cpl Microsoft Corporation nusrmgr.cpl Microsoft Corporation nwc.cpl Microsoft Corporation odbccp32.cpl Microsoft Corporation plugincpl131_01.cpl Sun Microsystems powercfg.cpl Microsoft Corporation QuickTime.cpl Apple Computer, Inc. sysdm.cpl Microsoft Corporation telephon.cpl Microsoft Corporation timedate.cpl Microsoft Corporation wuaucpl.cpl Microsoft Corporation wxfw.cpl The Weather Channel Interactive

01-01-2006, 10:10 AM	#16 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	final logs 5)Online kaspersky scan report: ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Sunday, January 01, 2006 09:51:48 Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 1/01/2006 Kaspersky Anti-Virus database records: 168523 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 41342 Number of viruses found: 43 Number of infected objects: 94 Number of suspicious objects: 0 Duration of the scan process: 6220 sec Infected Object Name - Virus Name C:\AGEU_SilentSudokuInstaller.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk C:\AGEU_SilentSudokuInstaller.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk C:\AGEU_SilentSudokuInstaller.exe Infected: Trojan-Dropper.Win32.VB.kk C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\03A40000.VBN Infected: Exploit.HTML.Mht C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\03A40001.VBN Infected: Trojan.Java.ClassLoader.f C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\03A40002.VBN Infected: Exploit.Java.ByteVerify C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04040000.VBN Infected: Trojan.Java.ClassLoader.Dummy.d C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\045C0000.VBN Infected: Exploit.HTML.Mht C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN Infected: Trojan-Downloader.Java.OpenConnection.v C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN/BlackBox.class Infected: Exploit.Java.ByteVerify C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN Infected: Trojan-Downloader.Java.OpenConnection.aa C:\l2mfix\l2mfix\backup.zip/dlls/DuvX.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\l2mfix\l2mfix\backup.zip/dlls/dvcobj.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\l2mfix\l2mfix\backup.zip/dlls/dwime.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\l2mfix\l2mfix\backup.zip/dlls/e8020idoe80c0.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\l2mfix\l2mfix\backup.zip/dlls/guard.tmp Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\l2mfix\l2mfix\backup.zip/dlls/j06mlaj11do.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\l2mfix\l2mfix\backup.zip Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\SS1001.exe/data0010 Infected: Trojan-Dropper.Win32.Small.qn C:\SS1001.exe Infected: Trojan-Dropper.Win32.Small.qn C:\sysreset\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0131533.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132697.dll Infected: Trojan-PSW.Win32.Agent.bu C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132698.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132702.dll Infected: not-a-virus:AdWare.Win32.SurfSide.aa C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132705.exe Infected: Trojan-Downloader.Win32.TSUpdate.l C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132708.exe Infected: Trojan-Downloader.Win32.TSUpdate.p C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132710.exe Infected: Trojan-Downloader.Win32.TSUpdate.n C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132712.exe Infected: Trojan-Downloader.Win32.TSUpdate.f C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe/WISE0009.BIN Infected: Trojan-Downloader.Win32.TSUpdate.n C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe/WISE0010.BIN Infected: Trojan-Downloader.Win32.TSUpdate.p C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe/WISE0011.BIN Infected: Trojan-Downloader.Win32.TSUpdate.l C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe/WISE0012.BIN Infected: Trojan-Downloader.Win32.TSUpdate.f C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132714.exe Infected: Trojan-Downloader.Win32.TSUpdate.f C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132715.exe Infected: not-virus:Hoax.Win32.Renos.aj C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132716.exe Infected: Trojan.Win32.StartPage.agt C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132717.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132723.dll Infected: Trojan-Spy.Win32.Small.dg C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132724.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132729.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132732.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132802.exe/data0001 Infected: not-a-virus:AdWare.Win32.CommAd.a C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132802.exe Infected: not-a-virus:AdWare.Win32.CommAd.a C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132803.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132804.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132805.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132806.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132807.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132810.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0132811.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0133139.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0133140.exe Infected: Trojan.Win32.Runner.h C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP452\A0133141.exe Infected: Trojan-Dropper.Win32.VB.kk C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133202.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133211.exe Infected: Trojan-Clicker.Win32.VB.kc C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133212.exe Infected: Trojan.Win32.StartPage.aw C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133213.dll Infected: not-a-virus:AdWare.Win32.Sud.a C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133215.exe Infected: Trojan-Downloader.Win32.Adload.l C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133259.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133339.exe Infected: Trojan-Downloader.Win32.PurityScan.ax C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133340.exe Infected: Trojan-Downloader.Win32.PassAlert.h C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133341.exe/data0006 Infected: Trojan-Dropper.Win32.VB.kk C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133341.exe Infected: Trojan-Dropper.Win32.VB.kk C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133347.exe Infected: Trojan-Downloader.Win32.PurityScan.ax C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133350.exe Infected: Trojan-Dropper.Win32.Small.qn C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133382.exe Infected: Trojan-Downloader.Win32.Adload.l C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133383.exe Infected: Trojan-Downloader.Win32.Small.bke C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133384.exe Infected: Trojan-Downloader.Win32.Qoologic.at C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133385.exe Infected: Trojan-Downloader.Win32.Small.cam C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133386.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133387.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133388.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133389.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133390.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133391.exe Infected: Trojan-Downloader.Win32.Small.buy C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133392.exe Infected: Trojan-Downloader.Win32.TSUpdate.o C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133396.dll Infected: Trojan-Clicker.Win32.Small.jf C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133397.exe Infected: Trojan-PSW.Win32.Agent.bu C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133398.exe Infected: Trojan-Downloader.Win32.Tiny.al C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133399.exe Infected: not-a-virus:AdWare.Win32.MDH.e C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133400.exe Infected: Packed.Win32.Klone.b C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133402.exe Infected: not-virus:Hoax.Win32.Renos.aj C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133403.exe Infected: Packed.Win32.Klone.b C:\System Volume Information\_restore{F7B919E1-38E3-448D-99ED-8435E43D79F7}\RP453\A0133406.exe Infected: Trojan-Downloader.Win32.Adload.j C:\windows\system32\DH9013.exe/data0002 Infected: Trojan-Clicker.Win32.Small.jf C:\windows\system32\DH9013.exe Infected: Trojan-Clicker.Win32.Small.jf C:\WINNT\Downloaded Program Files\applet.ocx Infected: Trojan-Downloader.Win32.VB.en C:\WINNT\system32\aqwad.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak Scan process completed.

01-01-2006, 11:13 AM	#18 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,489 OS: N/A	There's something erronous about the logs you have just posted. May I ask if you tried running Ewido from Normal Mode? Let's try it again... Please use Symantec's guide to remove the quarantine files. Please download the file attached - regdel.zip Save it on your desktop. We shall be needing it in Safe Mode * * * * * * KILLBOX * * * * * * * * * * * * * * * * * * * * * * * Launch KillBox.exe & select the following options: delete on Reboot All files (if available) Use your mouse to select all the filenames listed below & then right-click & select Copy C:\AGEU_SilentSudokuInstaller.exe C:\l2mfix\l2mfix\backup.zip C:\SS1001.exe C:\windows\system32\DH9013.exe C:\WINNT\Downloaded Program Files\applet.ocx C:\WINNT\system32\aqwad.dll C:\WINNT\system\nlelcsxrv.exe C:\WINNT\System32\klqkm.dll C:\WINNT\mkrvn.dll C:\WINNT\SYSTEM32\0wao7k9k.dll C:\Documents and Settings\All Users\Start Menu\Programs\Startup\oiwq.exe C:\Documents and Settings\ddarish\Start Menu\Programs\Startup\oiwq.exe * Go to the File menu, and choose Paste from Clipboard * Click the RED X button. * Click Yes at the Delete on Reboot prompt. * Click Yes at the 'Pending Operations prompt'. * * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * BATCHES / REG FIXES * * * * * * * * * * * * * * * * * From within regdel.zip, doubleclick regdel.reg & allow it to merge with the Registry This will remove some malware entries from the Registry * * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following: Delete Newsgroup cache Delete Newsgroup Subscriptions Scan local drives for temporary files 4. Click OK 5. Press the CleanUp! button to start the program. 6. Do NOT reboot/logoff if prompted. * * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * * Run Ewido again:(...it's important that all windows must be closed) Click Scanner Click Complete System Scan to begin scanning. Click OK when prompted to clean files With the first file it prompts to clean, select the option: "Perform action on all infections" .Choose clean and click OK. Once finished, click the Save report button & save the report to your desktop * * * * * * DEEP SCAN * * * * * * * * * * * * * * * * * * * * 1. From within the WinPFind folder, double click WinPFind.exe 2. Click Start Scan 3. Once the Scan is complete, it will create a report in a text file 4. Go to the WinPFind folder & locate WinPFind.txt 5. Post the results in your next reply! ** This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more. * * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * * Perform an online scan with Internet Explorer with Panda ActiveScan Click Scan your PC & a 'pop up' window shall appear. ensure that your pop up blocker doesn't block it Click Scan Now* Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls Begin the scan by selecting My Computer If it finds any malware, it will offer you a report. Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later. Click on see report. Then click Save report Post the contents of the report in your next reply You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. Turn off the real time scanner of any existing antivirus program while performing the online scan * * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh logs from: HiJackThis log Online Scan Ewido WinPfind Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Question - what have you done for the community today? Last edited by sUBs; 01-07-2006 at 02:13 PM.

01-01-2006, 03:46 PM	#19 (permalink)
darishetty Registered User Join Date: Dec 2005 Posts: 31 OS: XP prof	What is removing quarantine files and why and how it can be performed? Thanks..