Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page HJT Logfile Help (spy sheriff, BPS)
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 01-04-2006, 07:09 PM   #1 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


HJT Logfile Help (spy sheriff, BPS)
I keep getting popups in my system tray that say I have spyware on my computer and that I should download rogue software. If someone could help me with my log file I would appreciate it.

Logfile of HijackThis v1.99.1
Scan saved at 943 PM, on 1/4/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\Adam & Jill\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: HomepageBHO - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\System32\hp667A.tmp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} (Seagate DiscWizard English) - http://www.seagate.com/support/disc/...n/npdscwiz.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136410153452
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/def...ploader_v6.cab
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Sponsored Links
Old 01-04-2006, 11:54 PM   #2 (permalink)
1337 C0D3R
 
skate_punk_21's Avatar
 
Join Date: Mar 2005
Location: Canada
Posts: 1,457
OS: Server 2K3/XP Pro/XP MCE/Win 98/Ubuntu Linux/BackTrack 2

My System

Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop.

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Don't run it yet!

Next, please reboot your computer in SafeMode by doing the following:
  1. Restart your computer
  2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3. Instead of Windows loading as normal, a menu should appear
  4. Select the first option, to run Windows in Safe Mode.
Now scan with HJT and place a checkmark next to each of the following items and click FIX CHECKED:
===================================================
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: HomepageBHO - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\System32\hp667A.tmp
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
===================================================

Close HiJackThis.

Delete this folder in blue:
C:\Program Files\winupdates\

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Open Ad-aware and do a full scan. Remove all it finds.


Run Ewido:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
  • When the scan is finished, click the Save report button at the bottom of the screen.
  • Save the report to your desktop
Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut.
- Once you are on the Panda site click the Scan your PC button
- A new window will open...click the Check Now button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
- When download is complete, click on Local Disks to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of smitfiles.txt and the Ewido Log by using Add Reply.
Let us know if any problems persist.
__________________
Have I Helped you? Please Consider a Donation to TechSupportForums
skate_punk_21 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-05-2006, 11:58 AM   #3 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


Completed everything you reccommended
Here are all of the log files that you asked for. Thank you for all your help, my computer is working much better, but I think the panda activescan found a few more problems. Please let me know how to proceed.


Logfile of HijackThis v1.99.1
Scan saved at 1:23:30 PM, on 1/5/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Adam & Jill\Desktop\hijackthis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} (Seagate DiscWizard English) - http://www.seagate.com/support/disc/...n/npdscwiz.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136410153452
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/def...ploader_v6.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe



---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 1:21:28 PM, 1/5/2006
+ Report-Checksum: 6585574B

+ Scan result:

:mozilla.7:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Paycounter : Cleaned with backup
:mozilla.112:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.114:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.115:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.116:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.117:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.118:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.119:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.120:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.121:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.123:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.148:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.176:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.177:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.178:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.200:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.201:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.202:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.215:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.216:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.217:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.238:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.239:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.240:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.243:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.245:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.248:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.249:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.250:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.256:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.257:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.261:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.262:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.263:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.265:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.266:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.267:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.268:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.278:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.279:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.280:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.281:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.284:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.290:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
:mozilla.291:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
:mozilla.292:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.293:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.294:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.295:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.296:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.297:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.300:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.301:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.302:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.304:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.305:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.306:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.307:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.308:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.311:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.312:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.324:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.325:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.326:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.330:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
:mozilla.331:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Pro-market : Cleaned with backup
:mozilla.346:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.347:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.351:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.353:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.367:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.368:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.379:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.381:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.382:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.383:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.384:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.385:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.386:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.387:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.391:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.392:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.396:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.397:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.398:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.399:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Hitslink : Cleaned with backup
:mozilla.413:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.414:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.415:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.422:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.429:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.454:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.455:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.466:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.467:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.474:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.483:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.484:C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt -> Spyware.Cookie.Trafic : Cleaned with backup
C:\Documents and Settings\Adam & Jill\Cookies\adam & jill@msnportal.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Adam & Jill\Desktop\hijackthis\backups\backup-20060105-121934-482.dll -> Downloader.Zlob.dx : Cleaned with backup
C:\Documents and Settings\Adam & Jill\Local Settings\Temporary Internet Files\Content.IE5\ZBQL9YF8\gdnUS2296[1].exe -> Downloader.Small.ayl : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.12:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.12:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.97:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.104:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.110:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.111:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.112:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.114:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.118:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.119:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.121:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.123:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.156:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.159:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.160:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.161:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.163:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.167:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.168:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.176:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.177:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.181:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.182:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.183:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.198:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.202:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.205:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.207:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.209:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.210:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.212:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.217:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.220:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.221:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.227:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.242:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.245:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.256:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.257:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.259:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.260:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.261:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.262:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.269:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.274:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.275:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.276:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.277:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.278:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.279:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.280:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.281:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.282:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.283:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.284:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.286:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.294:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.295:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.296:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.297:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.299:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.306:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.307:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.308:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.309:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.310:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.311:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.312:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.313:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.318:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.319:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.320:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
:mozilla.322:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
:mozilla.323:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.324:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.335:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.336:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.337:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.338:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.339:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.343:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.344:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.356:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.389:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.390:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.391:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.409:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.410:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.411:C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Jill\Cookies\jill@msnportal.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Jill\Local Settings\Temporary Internet Files\Content.IE5\1MKBSDEC\popcaploader_v6[1].cab/PopCapLoader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup


::Report End



smitRem © log file
version 2.8

by noahdfear

Microsoft Windows XP [Version 5.1.2600]
The current date is: Thu 01/05/2006
The current time is: 12:22:55.68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key

PSGuard.com key not present!

checking for WinHound.com key
WinHound.com key not present!
spyaxe uninstaller NOT present
Winhound uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Existing Pre-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
Online Security Guide.url
Security Troubleshooting.url
~~~ Favorites ~~~
~~~ system32 folder ~~~

1024 dir
msvol.tlb
ld****.tmp
mssearchnet.exe
ncompat.tlb
nvctrl.exe
mscornet.exe
hp***.tmp

~~~ Icons in System32 ~~~

ts.ico
ot.ico

~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 700 'explorer.exe'

Starting registry repairs

Deleting files
Remaining Post-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
Online Security Guide.url
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~ Wininet.dll ~~~

CLEAN! :)


Panda Activescan logfile:

Incident Status Location

Spyware:Cookie/Ask Not disinfected C:\Documents and Settings\Adam & Jill\Application Data\Mozilla\Firefox\Profiles\pugd9ki7.default\cookies.txt[]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Adam & Jill\Cookies\adam & jill@searchportal.information[1].txt
Spyware:Cookie/SpySheriff Not disinfected C:\Documents and Settings\Adam & Jill\Cookies\adam & jill@www.spysheriff[1].txt
Dialer:Dialer.BEW Not disinfected C:\Documents and Settings\Adam & Jill\Local Settings\Temporary Internet Files\Content.IE5\PI8PK18B\connect[1][Content]
Dialer:Dialer.BEW Not disinfected C:\Documents and Settings\Adam & Jill\Local Settings\Temporary Internet Files\Content.IE5\PI8PK18B\connect[1].htm
Spyware:Cookie/Ask Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\cookies.txt[]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrator\Desktop\smitRem\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\agrnf3dj.default\Cache\3EFBEAA3d01[Process.exe]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Jill\Application Data\Mozilla\Firefox\Profiles\uiybq6ln.default\cookies.txt[]
Spyware:Cookie/QuestionMarket Not disinfected C:\Program Files\Webroot\Spy Sweeper\Quarantine\C_adam & jill@questionmarket[1][1]__txt.spy
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Program Files\Webroot\Spy Sweeper\Quarantine\C_adam & jill@trafficmp[2][1]__txt.spy
Spyware:Cookie/CentrPort Not disinfected C:\Program Files\Webroot\Spy Sweeper\Quarantine\C_jill@centrport[1][1]__txt.spy
Spyware:Cookie/QuestionMarket Not disinfected C:\Program Files\Webroot\Spy Sweeper\Quarantine\C_jill@questionmarket[1][1]__txt.spy
Potentially unwanted tool:Application/ServUBased.A Not disinfected G:\Setup Files\Downloading Programs\RhinoSoft Serv u 4 FTP server FULL with key gen.exe[SERVUDAEMON.EXE]
Hacktool:HackTool/OptixPatch Not disinfected G:\Setup Files\games\Snood\Snood30fix.exe
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-05-2006, 10:30 PM   #4 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,242
OS: N/A


Quote:
IMPORTANT!:


Before we can proceed any further, please visit the Microsoft's Windows Update Page and install ALL Critical Updates for your system (except service pack 2) (SP2). SP2 should only be installed on a fully disinfected system. At the minimum install at least SP1a for both XP and IE6. Without these updates your system is wide open to re-infection and we are both wasting our efforts to clean your system. After we have completed your clean-up, we will have you return to the Windows Update page and install SP2. We will also then advise you on how to better protect yourself online.

Please apply those updates BEFORE posting your next log. It is this forum's policy to stop the disinfection process until these basic updates are done. If during the updating process you get a message that your product key is invalid ....then you may not have a legitimate copy of Windows XP. Unfortunately it’s also this forums policy that we only address users with a legal copy of Windows XP.... therefore if you can not update Windows XP to SP1 we must stop the cleansing process here.


**Note** If your having trouble locating the service pack SP1a here is a direct link to download it from..

http://download.microsoft.com/downlo...p1a_en_x86.exe


Thank you for your cooperation.
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-06-2006, 10:30 AM   #5 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


Already have all Windows updates
I visited the windows update site and it says the only critical update available is SP2. I tried to download and install the SP1a update manually and I keep getting the following error:

"Service Pack 1 Setup Error"
The core system file (kernel) used to start this computer is not a Microsoft Windows file. The Service Pack will not be installed. For more information, see Knowledge Base article Q327101 at http://support.microsoft.com

I do not know how to proceed from here. It appears as though Spyaxe is still on my computer. Please help me finish cleaning my computer. I have not done anything other than trying to find windows updates to install since I posted my last log files. Thank you for all your help thus far. Where can I find information on how to read the logfiles you have been using to help me clean my system?
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-06-2006, 10:44 AM   #6 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,242
OS: N/A


Go to Start > Run - type in C:\boot.ini & click OK

Post it's contents here.


Start HJT & goto Config > Misc Tools - Open Uninstall Manager

Click the Save List button & post the the resultant log here.

Please highlight any entries that looks suspicious to you
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-06-2006, 04:15 PM   #7 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


follow up
Here is my boot.ini file

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (bootscreen)" /fastdetect /KERNEL=kernel1.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect


Here is the HJT uninstall list

Ad-Aware SE Personal
Adobe Download Manager 2.0 (Remove Only)
Adobe Reader 7.0.5
Ahead Nero Burning ROM
ewido anti-malware
HijackThis 1.99.1
iPod for Windows 2005-11-17
iTunes
J2SE Runtime Environment 5.0 Update 6
Lexmark X5100 Series
Macromedia Flash Player 8
Microsoft Office Professional Edition 2003
Mozilla Firefox (1.5)
NVIDIA nForce APU1 Utilities
Panda ActiveScan
QuickTime
RealPlayer
Seagate DiscWizard English
Spy Sweeper
Spybot - Search & Destroy 1.3
Winamp3 (remove only)
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB828741
Windows XP Hotfix - KB833407
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB842773
Windows XP Hotfix (SP1) [See Q329048 for more information]
Windows XP Hotfix (SP1) [See Q329390 for more information]
Windows XP Hotfix (SP1) [See Q329441 for more information]
Windows XP Hotfix (SP1) [See Q329834 for more information]
Windows XP Hotfix (SP1) Q329170
Windows XP Hotfix (SP1) Q810577
Windows XP Hotfix (SP1) Q810833
Windows XP Hotfix (SP1) Q817606
Windows XP Hotfix (SP2) [See Q329115 for more information]
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-06-2006, 04:20 PM   #8 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,242
OS: N/A


Edit your boot.ini file so that this is removed - /KERNEL=kernel1.exe
It should look like this..
Quote:
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional (bootscreen)" /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /fastdetect
Save the file & reboot your computer.

Then install SP1a & post a new HJT log
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-08-2006, 07:20 PM   #9 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


corrected Boot.ini and installed SP1a
I deleted the following whole line:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional (bootscreen)" /fastdetect /KERNEL=kernel1.exe

I think this was from when I used style XP and changed my boot screen. I was trying to figure out how to get rid of that extra boot option since it no longer worked. Thanks. Here is my updated HJT log file. Also, since the spyware problems, I have been having problems printing. I keep getting told that there is a problem communicating with my printer. Although, everything is connected properly. Do you have any advice on how to go about attacking this problem? Any general ideas would be helpful. Thanks


Logfile of HijackThis v1.99.1
Scan saved at 9:18:26 PM, on 1/8/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\NVATray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Adam & Jill\Desktop\hijackthis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} (Seagate DiscWizard English) - http://www.seagate.com/support/disc/...n/npdscwiz.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136410153452
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/def...ploader_v6.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE


I appreciate all the help. Thanks a Lot.
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-08-2006, 07:25 PM   #10 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


Where can I learn to resolve spyware problems and keep up to date on how to prevent spyware and malware as do all of the expert problem solvers on this forum? I would like to help others who get these nasty infections in their computers.
Last edited by bobberadam; 01-08-2006 at 07:43 PM.
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-09-2006, 01:27 AM   #11 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,242
OS: N/A


You appear to be reasonably clean but please humour me by doing this online scan.

Perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply along with a new HJT log
* Turn off the real time scanner of any existing antivirus program while performing the online scan
__________________
Last edited by sUBs; 01-09-2006 at 11:13 AM.
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-09-2006, 11:01 AM   #12 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


I completed the scan you requested and It found more problems, please help me get rid of the problems.

Thanks,


Logfile of HijackThis v1.99.1
Scan saved at 1:04:50 PM, on 1/9/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\NVATray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Adam & Jill\Desktop\hijackthis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} (Seagate DiscWizard English) - http://www.seagate.com/support/disc/...n/npdscwiz.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136410153452
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/def...ploader_v6.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE







-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Monday, January 09, 2006 13:03:40
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 9/01/2006
Kaspersky Anti-Virus database records: 170146
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 46772
Number of viruses found: 9
Number of infected objects: 109
Number of suspicious objects: 0
Duration of the scan process: 5679 sec

Infected Object Name - Virus Name
C:\Documents and Settings\Administrator\.housecall\Quarantine\a.tmp.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\a.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\a.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Battlefield 2 Special Forces.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Battlefield 2 Special Forces.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Bejeweled 2 Deluxe Plus.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Bejeweled 2 Deluxe Plus.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Broken Sword 3 - Sleeping Dragon.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Broken Sword 3 - Sleeping Dragon.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Cabelas Big Game Hunter 2006.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Cabelas Big Game Hunter 2006.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Counter Strike Source.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Counter Strike Source.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Daytona USA Deluxe.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Daytona USA Deluxe.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Dc80.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Dc80.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Deus Ex Invisible War.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Deus Ex Invisible War.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\DVD Copy 4.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\DVD Copy 4.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Electronics Workbench MultiSim Power Pro.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Electronics Workbench MultiSim Power Pro.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Eminem - Curtain Call.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Eminem - Curtain Call.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Empire Earth II.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Empire Earth II.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Fake Webcam 1.01.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Fake Webcam 1.01.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Harry Potter and the Goblet of Fire - Visions.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Harry Potter and the Goblet of Fire - Visions.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Hide IP Platinum 2.31.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Hide IP Platinum 2.31.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Hirens BOOTCD 7.7 January 2006.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Hirens BOOTCD 7.7 January 2006.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Internet Explorer 7 Plus.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Internet Explorer 7 Plus.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Kaspersky Anti-Virus Personal 2006.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Kaspersky Anti-Virus Personal 2006.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Medal Of Honor Allied Assault.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Medal Of Honor Allied Assault.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Metal Gear Solid.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Metal Gear Solid.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Microsoft Money 2006 Deluxe.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Microsoft Money 2006 Deluxe.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\MSN Messenger 8 Plus.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\MSN Messenger 8 Plus.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Network Administrator’s Toolkit.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Network Administrator’s Toolkit.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\NiceDice 2.2.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\NiceDice 2.2.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Playboy The Mansion.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Playboy The Mansion.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Rapidshare Instant Downloader.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Rapidshare Instant Downloader.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Roxio Easy Media Creator 8 Suite Plus.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Roxio Easy Media Creator 8 Suite Plus.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Setup.exe.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Smart CD Ripper 3.4.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Smart CD Ripper 3.4.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\South Park Rally.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\South Park Rally.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\svchosts.dll.bac_a01500 Infected: not-virus:Hoax.Win32.Renos.af
C:\Documents and Settings\Administrator\.housecall\Quarantine\Swat 3 Close Quarters Battle.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Swat 3 Close Quarters Battle.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Thief 3 Deadly Shadows.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Thief 3 Deadly Shadows.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Trojan Remover 6.4.6.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Trojan Remover 6.4.6.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\TweakNow Powerpack 2006 Pro.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\TweakNow Powerpack 2006 Pro.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\TweakNT - Removes Windows Timebomb.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\TweakNT - Removes Windows Timebomb.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Ultimate ZIP Cracker 7.3.1.5.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Ultimate ZIP Cracker 7.3.1.5.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Unlocker 1.7.6.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Unlocker 1.7.6.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Vista Tranformation Pack 2 XP.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Vista Tranformation Pack 2 XP.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\War of the Worlds.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\War of the Worlds.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Warcraft AIO (4 in 1).zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Warcraft AIO (4 in 1).zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Warhammer 40.000 - Dawn of War.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Warhammer 40.000 - Dawn of War.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\winupdates.exe.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Zealot All Video Joiner 1.9.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Zealot All Video Joiner 1.9.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Zuma Deluxe Plus.zip.bac_a01500/Setup.exe Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Administrator\.housecall\Quarantine\Zuma Deluxe Plus.zip.bac_a01500 Infected: Email-Worm.Win32.VB.an
C:\Documents and Settings\Jill\Local Settings\Temporary Internet Files\Content.IE5\PI8PK18B\popcaploader_v6[1].cab/PopCapLoader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b
C:\Documents and Settings\Jill\Local Settings\Temporary Internet Files\Content.IE5\PI8PK18B\popcaploader_v6[1].cab Infected: not-a-virus:Downloader.Win32.PopCap.b
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP38\A0002944.tlb Infected: Trojan-Downloader.Win32.Zlob.dx
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP38\A0002956.exe/WISE0018.BIN Infected: Trojan-Downloader.Win32.Small.bke
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP38\A0002956.exe/WISE0019.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP38\A0002956.exe Infected: not-a-virus:AdWare.Win32.NewDotNet
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP39\A0003012.tlb Infected: Trojan-Downloader.Win32.Zlob.dx
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP41\A0003057.tlb Infected: Trojan-Downloader.Win32.Zlob.dx
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP53\A0003635.exe Infected: Email-Worm.Win32.VB.an
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP53\A0003636.exe Infected: Email-Worm.Win32.VB.an
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP53\A0003660.tlb Infected: Trojan-Downloader.Win32.Zlob.dx
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP53\A0003661.exe Infected: Trojan-Downloader.Win32.Zlob.dw
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP53\A0003663.exe Infected: Trojan-Downloader.Win32.Zlob.dx
C:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP53\A0003664.exe Infected: Trojan-Downloader.Win32.Zlob.dy
C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b
G:\Setup Files\Downloading Programs\RhinoSoft Serv u 4 FTP server FULL with key gen.exe/susetup.exe/SERVUDAEMON.EXE Infected: not-a-virus:Server-FTP.Win32.Serv-U.40
G:\Setup Files\Downloading Programs\RhinoSoft Serv u 4 FTP server FULL with key gen.exe/susetup.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.40
G:\Setup Files\Downloading Programs\RhinoSoft Serv u 4 FTP server FULL with key gen.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.40
G:\System Volume Information\_restore{CCFE7785-0B68-455E-9130-253DF7FEE434}\RP53\A0003637.exe Infected: Email-Worm.Win32.VB.an

Scan process completed.
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-09-2006, 11:24 AM   #13 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,242
OS: N/A


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.


* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * *


Right click on this & choose "Save As..." DelO15Domains.inf - DelO15Domains.inf
Right click on DelO15Domains.inf and choose Install. It will run immediately (you won't be able to see anything happen). You may delete the file afterwards.

Host.zip - From within Host.zip, double click on MVPS.bat & allow it to run.

Right click on this & select 'Save As' - DNSManual.bat
Doubleclick on DNSManual.bat & allow it to run.

SpywareBlaster 3.5.1
Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items

IE-SpyAD - Extract the contents to a new folder
From within the folder, double-click install.bat
Select Option #2 - Install the new IE-SPYAD list.
Then return to the main menu.
Select option #4 - Add the old porn sites domain

Download & install - CleanUp.exe (not recommended for WinXP64)

'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding.
It is IMPORTANT that you don't miss a step & perform everything in the correct order.


* * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * *


Delete the contents of this folders, leaving it empty:
  • C:\Documents and Settings\Administrator\.housecall\Quarantine\

This file, you can choose to keep. But it poses a security risk

G:\Setup Files\Downloading Programs\RhinoSoft Serv u 4 FTP server FULL with keygen.exe


* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * *


Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider initially to Standard CleanUp!
3. Uncheck the following:
  • Delete Newsgroup cache
  • Delete Newsgroup Subscriptions
  • Scan local drives for temporary files
4. Click OK
5. Press the CleanUp! button to start the program.
6. Do NOT reboot/logoff if prompted.

* CleanUp! will not create any backups!!


* * * * * * USING HIJACKTHIS' DELETE ON REBOOT * * * * * *


Start HiJackThis & go to Config>Misc.Tools> Delete a file on reboot...
  1. In the popup box that appears, copy/paste in:
    • C:\WINDOWS\Downloaded Program Files\popcaploader.dll
  2. Click the Open button.
  3. Click YES when prompted to restart your computer.

* * * *


This will empty the System Volume Information folder
Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
  • Tick on the checkbox - Turn off System Restore on all drives
  • Click Apply
Turn it back 'On' by unticking the same checkbox & click OK


Let me know how that went
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-12-2006, 09:22 AM   #14 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


Completed what you asked
I completed the above procedure you reccommended. I did not have a problem with any of it. Do you want to see any log files to determine if my system is clean? If so, which ones do you want to see. Also is it normal for the Cleanup! program to delete around 14000 files and approximately 720MB? That seems like a lot.

Once again thanks for your help.
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-12-2006, 09:25 AM   #15 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


Here is an updated HJT Log.

Logfile of HijackThis v1.99.1
Scan saved at 11:30:10 AM, on 1/12/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\NVATray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Adam & Jill\Desktop\hijackthis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} (Seagate DiscWizard English) - http://www.seagate.com/support/disc/...n/npdscwiz.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136410153452
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/def...ploader_v6.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-12-2006, 09:35 AM   #16 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 23,242
OS: N/A


Quote:
Also is it normal for the Cleanup! program to delete around 14000 files and approximately 720MB? That seems like a lot.
That's nothing to worry about. You merely reclaimed 720 MB worth of disk space unnecessarily occupied by temp files & other garbage. Some users with even larger disks were able to reclaim gigabytes worth of space.


Your system is clean. Have you patched yourself against the WMF exploit yet? If not, please refer to my sig. Kindly follow these simple steps in order to keep your computer clean and secure:

  1. CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
    Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
    • Tick on the checkbox - Turn off System Restore on all drives
    • Click Apply
    Turn it back 'On' by unticking the same checkbox & click OK


  2. DISABLE THE VIEWING OF SYSTEM FILES
    From Windows Explorer, go to Tools>Folder Options> View tab.
    • Untick - Show hidden files and folder
    • Tick - Hide file extensions for known types
    • Tick - Hide protected operating system files
    Click Yes to confirm & then click OK


  3. SECURING INTERNET EXPLORER
    From within Internet Explorer click on the Tools menu and then click on Internet Options.
    • Select the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Select Custom Level .
        • Change 'Download signed ActiveX controls' to Prompt
        • Change 'Download unsigned ActiveX controls' to Disable
        • Change 'Initialize and script ActiveX controls not marked as safe' to Disable
        • Change 'Installation of desktop items' to Prompt
        • Change 'Launching programs and files in an IFRAME' to Prompt
        • Change 'Navigate sub-frames across different domains' to Prompt
        • When all these changes have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Select OK to exit the Internet Properties page.


  4. ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

    It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


  5. FIREWALL
    Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.


  6. Microsoft Windows Update
    Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


  7. SPYBOT - SEARCH & DESTROY
    Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here


  8. AD-AWARE
    Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here


  9. SPYWAREBLASTER
    SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.

    Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here


  10. IE-SPYAD
    IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here


  11. MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. It can be downloaded here - MVPS Hosts file

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
  • Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • Google Toolbar - Get the free google toolbar to help stop pop up windows.

  • CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

  • Winpatrol - Download and install the free version of Winpatrol.
    A tutorial for this product is located here:
    Using Winpatrol to protect your computer from malicious software

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 01-12-2006, 10:35 AM   #17 (permalink)
Registered User
 
Join Date: Jan 2006
Posts: 10
OS: XP Professional


Thanks for all the help
My computer seems to be working great again. Thanks for all the help.
bobberadam is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 12:24 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84