Error loading c:\windows\cfgmgr52.dll

ybouch · 02-17-2006, 10:40 AM

Hello to you all!

When booting Windows XP, I always get this error message : Error loading c:\windows\cfgmgr52.dll. The specified module could not be found.

Someone told me I had the Booked Space malware and gave me a procedure to get rid of it. Of course, a whole lot of garbage were removed, but not the one that still gives me the above error message.

I updated my OS, ran AVG, then Ewido, Ad-Aware, Spybot and SpyBlaster (all in safe mode). I tried to run the built-in Sysclean task, but failed to perform.

My HJT log is tremendously large and my computer so slow, I'm sure it is still infected with many unwanted programs. Would you check it out?

PS: I'm not able to send the whole log. I cropped the log a bit so it can fit in this post. What I cut is more of the same.

Logfile of HijackThis v1.99.1
Scan saved at 18:40:28, on 2006-02-16
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Palm\HOTSYNC.EXE
G:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://internet.videotron.ca/contrat
R3 - URLSearchHook: (no name) - {576EE28D-1F4A-BA55-99EE-295D21D726CB} - C:\WINDOWS\hccztttl.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {D505AAEC-D1B6-EE4A-8CC6-08A770F2D084} - C:\WINDOWS\hccztttl.dll (file missing)
O3 - Toolbar: Search - {8570F4E2-0EA1-7E20-480E-C465383548F3} - C:\WINDOWS\hccztttl.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [FtkCPY] "C:\Program Files\Common Files\Java\ftkcpy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [xvelahc] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [ahbexrk] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [hqgsuvh] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [jilkmny] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [jgmfphc] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [uwvbkkc] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [tffqckj] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [vbvhnlp] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [xlyeixa] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [uauqwoq] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [xkqntit] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [bbyqoft] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [qyprxbr] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [xbytqws] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [dkrotvy] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [lgioinl] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [ubqghvo] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [chukxvb] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [rqgldmf] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [omfidfe] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [apwjhxb] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [yrsbxmv] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [nhrsuwy] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [qxxtluv] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [dqheuqc] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [adygxtw] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [kwgetkf] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [cxwyuoh] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [ppdbyug] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [bnsenje] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [cbujjca] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [uginrhi] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [ldfjnqm] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [ksmtxit] c:\windows\qmcocra.exe
O4 - HKCU\..\Run: [yandrdq] c:\windows\aqaqfqd.exe
O4 - HKCU\..\Run: [xevbdbt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ddpcncl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tsfvunk] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [qouuppr] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [iaarugi] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [bmhwaot] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [rluyxsh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [eveyhvb] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [mwnoxwl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [opjochf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [igevyxm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [delhmfe] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [nrvriny] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dlqbqqq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [owobyjn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dvpuysc] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [aqqsnve] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [yhajwkl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hanqxju] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tqdwknf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [kkbylqo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hgogsch] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [bitdlqm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wcecbah] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [mfhqojw] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ycowhbg] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [nsjuvmh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [eqlrabj] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ugtyqwx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vrepgpq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uqjvaur] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [muekrbt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dqaovbs] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fapnkmy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wbyokoq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [klxfhlw] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vsrhlpf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fnwgysu] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [erkovsp] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ntutfoi] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [migxcnj] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [jfxocaw] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uiuxumn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [atbkmxq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [yrfujfy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [usmdivy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gxejsrq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [bgfpgnl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gyxmcnt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [atwgaqq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ovjnssn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dcbsdve] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [sflmwff] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [aeghqdm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [avaauta] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [rgjushe] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [nppbpwk] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xbdsngv] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gpkskfb] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [khebabo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [csyqpgf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hytpxow] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [cpmyvmu] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [pggstng] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [oqoslla] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [shrgulj] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [posqqok] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xalrdms] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gddpbas] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [cfaaycu] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wifkcxb] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [kineugc] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ytrvket] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dabvtve] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gkiaqyv] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ihylura] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [pkwduew] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vdkhijb] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [rvafhws] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [heylotp] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [nbnvjdg] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wpaqdtj] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [mriiedl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uvnopjm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ycuympg] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [catgiwm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [lwuatoo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vydgxsn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ktemell] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tsuqije] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ktaunlf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [cawsknx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fxefqfr] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hefqcyh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uarahvh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [joksfdd] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wqmoqgs] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [lybupqy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xwsgotc] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hoschqq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [paucxym] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xchekun] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [jnwgefl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ljgnuhh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [qrwhrwt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [sctbyli] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [pbbinot] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dypgokr] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [sthcayi] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ogbmajq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [jsujgqp] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [khusnvp] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [oglvfrt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [kvjgdkv] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xeqiixx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wgxgawr] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hyrvmij] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tgseend] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tovvvsa] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xygujsi] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uaywcbf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [heqfqbl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [yvjehmf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gabpjlw] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [irwebgy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [cududwo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [mxtrvra] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hmpuphh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tysahna] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ebttury] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [sreqfla] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [njdgxuf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fjgfjbc] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [bpjwtys] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ymhtqgs] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fotdvdx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fktdsrm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xlhqpkn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vaecppq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ldiqbag] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [krxeedx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hnywtbo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [psincte] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [alnruel] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [orjukpq] c:\windows\jnqoaxt.exe
O4 - HKCU\..\Run: [fthkimf] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [ijigetr] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [lsjhasq] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [oiffrto] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [njdgovm] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [shhhaxt] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [wufmxnt] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [ejnfknl] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [xpbptlh] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [usegrmf] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [cvmkcks] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [yrxdsot] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [ktuwaxm] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [fsxxopb] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [ecvjbqm] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [wdwaoxv] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [lxrgixs] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [ydqavmk] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [mqqidsf] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [qxremwh] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [bnnnadk] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [nndbtbj] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [vxamrey] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [ejskbot] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [nbewfbb] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [inykmbp] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [nqdxnlo] c:\windows\jvrrwsy.exe
O4 - HKCU\..\Run: [xxuktin] c:\windows\jvrrwsy.exe
O4 - HKCU\..\Run: [vmgxrva] c:\windows\jvrrwsy.exe
O4 - HKCU\..\Run: [uftfkvy] c:\windows\jvrrwsy.exe
O4 - HKCU\..\Run: [lctlmnd] c:\windows\kfjnotx.exe
O4 - HKCU\..\Run: [dliteca] c:\windows\kfjnotx.exe
O4 - HKCU\..\Run: [jeuyixb] c:\windows\kfjnotx.exe
O4 - HKCU\..\Run: [HijackThis startup scan] G:\Hijackthis\HijackThis.exe /startupscan
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = ?
O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {3DC02A8F-7B62-4198-A8AB-1E5ED8668B16} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3DC02A8F-7B62-4198-A8AB-1E5ED8668B16} - (no file) (HKCU)
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {4BDEC07B-A230-2495-885C-029F2327607B} - http://66.117.37.5/1/rdgCA283.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...92/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe

sUBs · 02-18-2006, 01:42 AM

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted.

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * *

Download & install - CleanUp.exe (not recommended for WinXP64)

Download & extract it to it's own folder - About Buster.zip.

Download & extract it to it's own folder - smitRem.exe

You will need to update Ewido to the latest definition files.
Launch Ewido & click Update from the left pane
Then click on Start Update.
If you are having problems with the updater, you can use this link to manually update Ewido
When you have finished updating, EXIT Ewido.

'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * *

Do a HijackThis scan & place a check next to these items and select "Fix checked":

R3 - URLSearchHook: (no name) - {576EE28D-1F4A-BA55-99EE-295D21D726CB} - C:\WINDOWS\hccztttl.dll (file missing)
O2 - BHO: (no name) - {D505AAEC-D1B6-EE4A-8CC6-08A770F2D084} - C:\WINDOWS\hccztttl.dll (file missing)
O3 - Toolbar: Search - {8570F4E2-0EA1-7E20-480E-C465383548F3} - C:\WINDOWS\hccztttl.dll (file missing)
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [FtkCPY] "C:\Program Files\Common Files\Java\ftkcpy.exe"
O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe"
O4 - HKCU\..\Run: [xvelahc] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [ahbexrk] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [hqgsuvh] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [jilkmny] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [jgmfphc] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [uwvbkkc] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [tffqckj] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [vbvhnlp] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [xlyeixa] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [uauqwoq] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [xkqntit] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [bbyqoft] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [qyprxbr] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [xbytqws] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [dkrotvy] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [lgioinl] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [ubqghvo] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [chukxvb] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [rqgldmf] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [omfidfe] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [apwjhxb] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [yrsbxmv] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [nhrsuwy] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [qxxtluv] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [dqheuqc] c:\windows\xkljwos.exe
O4 - HKCU\..\Run: [adygxtw] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [kwgetkf] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [cxwyuoh] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [ppdbyug] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [bnsenje] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [cbujjca] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [uginrhi] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [ldfjnqm] c:\windows\gqplexh.exe
O4 - HKCU\..\Run: [ksmtxit] c:\windows\qmcocra.exe
O4 - HKCU\..\Run: [yandrdq] c:\windows\aqaqfqd.exe
O4 - HKCU\..\Run: [xevbdbt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ddpcncl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tsfvunk] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [qouuppr] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [iaarugi] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [bmhwaot] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [rluyxsh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [eveyhvb] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [mwnoxwl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [opjochf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [igevyxm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [delhmfe] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [nrvriny] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dlqbqqq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [owobyjn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dvpuysc] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [aqqsnve] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [yhajwkl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hanqxju] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tqdwknf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [kkbylqo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hgogsch] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [bitdlqm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wcecbah] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [mfhqojw] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ycowhbg] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [nsjuvmh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [eqlrabj] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ugtyqwx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vrepgpq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uqjvaur] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [muekrbt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dqaovbs] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fapnkmy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wbyokoq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [klxfhlw] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vsrhlpf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fnwgysu] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [erkovsp] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ntutfoi] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [migxcnj] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [jfxocaw] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uiuxumn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [atbkmxq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [yrfujfy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [usmdivy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gxejsrq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [bgfpgnl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gyxmcnt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [atwgaqq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ovjnssn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dcbsdve] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [sflmwff] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [aeghqdm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [avaauta] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [rgjushe] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [nppbpwk] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xbdsngv] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gpkskfb] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [khebabo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [csyqpgf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hytpxow] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [cpmyvmu] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [pggstng] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [oqoslla] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [shrgulj] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [posqqok] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xalrdms] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gddpbas] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [cfaaycu] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wifkcxb] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [kineugc] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ytrvket] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dabvtve] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gkiaqyv] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ihylura] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [pkwduew] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vdkhijb] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [rvafhws] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [heylotp] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [nbnvjdg] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wpaqdtj] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [mriiedl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uvnopjm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ycuympg] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [catgiwm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [lwuatoo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vydgxsn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ktemell] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tsuqije] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ktaunlf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [cawsknx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fxefqfr] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hefqcyh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uarahvh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [joksfdd] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wqmoqgs] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [lybupqy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xwsgotc] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hoschqq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [paucxym] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xchekun] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [jnwgefl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ljgnuhh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [qrwhrwt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [sctbyli] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [pbbinot] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [dypgokr] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [sthcayi] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ogbmajq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [jsujgqp] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [khusnvp] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [oglvfrt] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [kvjgdkv] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xeqiixx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [wgxgawr] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hyrvmij] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tgseend] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tovvvsa] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xygujsi] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [uaywcbf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [heqfqbl] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [yvjehmf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [gabpjlw] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [irwebgy] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [cududwo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [mxtrvra] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hmpuphh] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [tysahna] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ebttury] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [sreqfla] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [njdgxuf] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fjgfjbc] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [bpjwtys] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ymhtqgs] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fotdvdx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [fktdsrm] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [xlhqpkn] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [vaecppq] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [ldiqbag] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [krxeedx] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [hnywtbo] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [psincte] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [alnruel] c:\windows\jsakuyk.exe
O4 - HKCU\..\Run: [orjukpq] c:\windows\jnqoaxt.exe
O4 - HKCU\..\Run: [fthkimf] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [ijigetr] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [lsjhasq] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [oiffrto] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [njdgovm] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [shhhaxt] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [wufmxnt] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [ejnfknl] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [xpbptlh] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [usegrmf] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [cvmkcks] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [yrxdsot] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [ktuwaxm] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [fsxxopb] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [ecvjbqm] c:\windows\enkpyeo.exe
O4 - HKCU\..\Run: [wdwaoxv] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [lxrgixs] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [ydqavmk] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [mqqidsf] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [qxremwh] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [bnnnadk] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [nndbtbj] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [vxamrey] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [ejskbot] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [nbewfbb] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [inykmbp] c:\windows\jryqhxk.exe
O4 - HKCU\..\Run: [nqdxnlo] c:\windows\jvrrwsy.exe
O4 - HKCU\..\Run: [xxuktin] c:\windows\jvrrwsy.exe
O4 - HKCU\..\Run: [vmgxrva] c:\windows\jvrrwsy.exe
O4 - HKCU\..\Run: [uftfkvy] c:\windows\jvrrwsy.exe
O4 - HKCU\..\Run: [lctlmnd] c:\windows\kfjnotx.exe
O4 - HKCU\..\Run: [dliteca] c:\windows\kfjnotx.exe
O4 - HKCU\..\Run: [jeuyixb] c:\windows\kfjnotx.exe
O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe
O9 - Extra button: Microsoft AntiSpyware helper - {3DC02A8F-7B62-4198-A8AB-1E5ED8668B16} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3DC02A8F-7B62-4198-A8AB-1E5ED8668B16} - (no file) (HKCU)
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {4BDEC07B-A230-2495-885C-029F2327607B} - http://66.117.37.5/1/rdgCA283.exe

* * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * *

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the option to run Windows in Safe Mode.

* * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * *

If you have not done so already, please enable the viewing of Hidden files
From Windows Explorer, go to Tools -> Folder Options -> View tab.

Tick - 'Show hidden files and folder'
Untick - 'Hide file extensions for known types'
Untick - 'Hide protected operating system files'
Click Yes to confirm & then click OK

Locate and delete the following files/folders: (let me know if you fail to find/delete any)

C:\WINDOWS\System32\P2P Networking\
C:\Program Files\Security iGuard\
C:\WINDOWS\cfgmgr52.dll
C:\Program Files\Common Files\Java\ftkcpy.exe
c:\windows\xkljwos.exe
c:\windows\gqplexh.exe
c:\windows\aqaqfqd.exe
c:\windows\jsakuyk.exe
c:\windows\kfjnotx.exe
C:\Program Files\Common Files\updater\

* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * *

Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider initially to Standard CleanUp!
3. Uncheck the following:

Delete Newsgroup cache
Delete Newsgroup Subscriptions
Scan local drives for temporary files

4. Click OK
5. Press the CleanUp! button to start the program.
6. Do NOT reboot/logoff if prompted.

* CleanUp! will not create any backups!!

* * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * *

Run About Buster and click - Begin Removal.
Locate 'Ab LogFile.txt' (... in the same folder as AboutBuster) and post it in your next reply.

* * * *

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

* * * *

Next go to Control Panel click Display>Desktop>Customize Desktop>Website
Under the 'Web pages' box, Uncheck everything present.

* * * * *

Run Ewido with it's updated definitions:(...it's important that all windows must be closed)

Click Scanner
Click Complete System Scan to begin scanning.
Click OK when prompted to clean files

With the first file it prompts to clean, select the option:

"Perform action on all infections"
.Choose clean and click OK.

Once finished, click the Save report button & save the report to your desktop

** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete.

* * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * *

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

* * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * *

In your next post, please include fresh logs from:

HiJackThis

Smitfiles.txt

Online scan

About Buster

Ewido

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

ybouch · 02-22-2006, 02:36 PM

Hi,

My computer is running much faster now.

I fail to find the following folders/files:
- C:\Windows\System32\P2P Networking\
- C:\Program Files\Security iGuard\
- c:\Windows\cfgmgr52.dll
- C:\Program Files\Common Files\Java\ftkxpy.exe
- c:\windows\xkljwos.exe
- c:\Windows\gqplexh.exe
- C:\Program Files\Common Files\updater\

The disk cleanup tool of RunThis.bat did'nt run after hours and hours waiting. (smitRem).

Logfile of HijackThis v1.99.1
Scan saved at 15:33:59, on 2006-02-22
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\NetAssistant\bin\mpbtn.exe
F:\Nettoyeurs de cochonneries\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://internet.videotron.ca/contrat
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Assistant Internet.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...92/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe

smitRem © log file
version 2.8

by noahdfear

Microsoft Windows XP [Version 5.1.2600]
The current date is: 2006-02-21
The current time is: 10:45:54,76

Running from
F:\Nettoyeurs de cochonneries\smitRem\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key

PSGuard.com key not present!

checking for WinHound.com key

WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1120 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~ Wininet.dll ~~~

wininet.dll is missing!!

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Wednesday, February 22, 2006 2:22:28 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 22/02/2006
Kaspersky Anti-Virus database records: 178140
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 121067
Number of viruses found: 26
Number of infected objects: 282
Number of suspicious objects: 8
Duration of the scan process: 01:12:29

Infected Object Name / Virus Name / Last Action
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED/quatrièmes.exe Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED/quatrièmes.exe Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx Mail MS Outlook 5: infected - 4 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Altnet45.zip/asmend.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Altnet45.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Altnet9.zip/asmend.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Altnet9.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer2.zip/optimize.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer2.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer9.zip/optimize.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer9.zip ZIP: suspicious - 1 skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0084.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0084.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0084.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0087.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0087.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0087.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0088.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0089.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0089.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0089.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0089.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0089.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0089.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0089.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0090.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skipped
C:\Program Files\Calendar Builder\clipartfree.exe/WISE0091.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.i skipped
C:\Program Files\Calendar Builder\clipartfree.exe WiseSFX: infected - 16 skipped
C:\Program Files\Calendar Builder\clipartfree.exe WiseSFX Dropper: infected - 16 skipped
C:\Program Files\Ftk\Uninst.exe/data0001 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.b skipped
C:\Program Files\Ftk\Uninst.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP837\A0118687.exe/data0001 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.b skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP837\A0118687.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP839\A0118770.exe/data0002 Infected: Trojan.Win32.Agent.cd skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP839\A0118770.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP839\A0118774.exe/data0001 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.b skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP839\A0118774.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP840\A0119060.exe Infected: Trojan.Win32.Favadd.w skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP845\A0119594.dll Infected: not-a-virus:Server-Proxy.Win32.MarketScode.c skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119627.exe/data0002 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.b skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119627.exe/data0003/data0002 Infected: not-a-virus:AdWare.Win32.Broadcap.b skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119627.exe/data0003 Infected: not-a-virus:AdWare.Win32.Broadcap.b skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119627.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119628.exe/data0002 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.b skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119628.exe/data0003/data0002 Infected: Trojan.Win32.Agent.cd skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119628.exe/data0003 Infected: Trojan.Win32.Agent.cd skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119628.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119629.exe/data0002 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.b skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119629.exe/data0003/data0002 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119629.exe/data0003 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119629.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119630.exe/data0002 Infected: not-a-virus:AdWare.Win32.FlashEnhancer.b skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119630.exe/data0003/data0002 Infected: Trojan.Win32.Starter.g skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119630.exe/data0003 Infected: Trojan.Win32.Starter.g skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP846\A0119630.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP852\A0120695.exe Infected: Trojan.Win32.Favadd.w skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP852\A0120734.exe Infected: Trojan.Win32.Favadd.w skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP852\A0120735.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\abtsrge.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ajbecll.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ajtgxjj.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\akhrdjf.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\astupgradecpr.exe/WISE0008.BIN Infected: Trojan-Downloader.Win32.Adroar skipped
C:\WINDOWS\astupgradecpr.exe/WISE0009.BIN Infected: Trojan-Downloader.Win32.Adroar skipped
C:\WINDOWS\astupgradecpr.exe WiseSFX: infected - 2 skipped
C:\WINDOWS\atdlpvj.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\awtuxhq.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bbwsmin.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bgjytwd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bgvrnkc.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bhiqsfn.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bihdigd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bilxqqk.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\blnjbed.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bnfsbli.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bpcdiex.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bptjjcf.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\brjtllt.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\bsxssde.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\celbasy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\cevbhmx.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\cswvgli.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ctymoar.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\cyxolsy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ddahevf.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\dilhtyu.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\dipgctp.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\djssode.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\doaoqra.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\doseoay.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\dqegeam.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\drbyrve.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ealfxll.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ebqpwuk.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ecfcrqj.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ehpkkjt.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ejmiwbd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\enkpyeo.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\epkrtth.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\eptysct.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\eukhutk.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\exjacjn.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\eyjukhl.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\fcqeoox.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\fdatwib.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\fkohtaw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\fngplnc.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\fodvqqf.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\fptrdch.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\fqmbbmm.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\fqysdwu.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\gmihnub.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\gpwfjiq.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\gwxsjnk.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\hbvttqg.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\hchghur.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\heinekd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\hpjbska.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\hwoyfsg.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ib.exe/WISE0006.BIN Infected: Trojan-Downloader.Win32.Agent.ct skipped
C:\WINDOWS\ib.exe/WISE0007.BIN Infected: Trojan-Spy.Win32.Briss.j skipped
C:\WINDOWS\ib.exe/WISE0008.BIN/wbhshare.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\WINDOWS\ib.exe/WISE0008.BIN/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\WINDOWS\ib.exe/WISE0008.BIN/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\WINDOWS\ib.exe/WISE0008.BIN/whieshm.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\WINDOWS\ib.exe/WISE0008.BIN/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.290 skipped
C:\WINDOWS\ib.exe/WISE0008.BIN Infected: not-a-virus:AdWare.Win32.WebHancer.290 skipped
C:\WINDOWS\ib.exe/WISE0010.BIN Infected: Trojan-Dropper.Win32.Agent.og skipped
C:\WINDOWS\ib.exe WiseSFX: infected - 9 skipped
C:\WINDOWS\idvdafo.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\iqrjhhy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\isewobw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ismkgls.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jhimlin.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jnelrbi.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jnhtvbu.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jnqoaxt.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jqnfufw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jrkgpuc.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jryqhxk.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jtuuhiy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jujiptg.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\juwrjeq.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\jvrrwsy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\kdheway.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\kdkdyjl.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\keksvya.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\kncdgjq.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\knyfcht.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\kskvaxw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\kxqwwnv.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\kytjkoc.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\kyuvxjj.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ldsixkg.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\lewqgdy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ljsgacm.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\lkqvgnc.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\lksgohr.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\lkxyrui.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\loyfiao.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\lrpigpi.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\lymrqje.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\mduikog.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\mgvvlmj.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\mnepfvy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\mnjxjcj.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\mqirnyd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\mvjwcec.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ncgtnrv.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ndaqduy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\nftdvvf.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\nhvglfm.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\nmimhpn.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\nsnijmv.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\nwaiujy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\nwbnksy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\nylxxmd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\oasbfli.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\obuoydo.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\odcpwgu.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\oewasym.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ojjfncm.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\okaxeym.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\omvbcij.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\oqtnnnt.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\papffbk.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\patdjvu.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\pauuqdd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\pbvfvcp.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\pkyvnhp.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\plwtdsf.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\pmqyvwa.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\pqwqbdp.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\prmlbkm.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\psepdyw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\pugaydt.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\pvcgyss.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\pvcrtsa.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qahvuvw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qanrdvg.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qbieptm.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qdajoiv.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qenvkkl.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qevrlnf.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qkhpmda.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qugqrdg.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qvmpveh.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\qvnnhar.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\rfdsypg.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\rhglmgu.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\rldyiwv.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\rlgxfsn.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\rphywsw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\rpssrpa.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\rukihya.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ruslkan.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\rxbvggx.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\SbCIe0261.dll Infected: not-a-virus:AdWare.Win32.SideStep.c skipped
C:\WINDOWS\sgsuhmd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\sqohaqe.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\srmjagq.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\sruwfex.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\supybas.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\suqjdvp.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\sydawws.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\SYSTEM32\asncpvqq.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\SYSTEM32\AST.exe/WISE0006.BIN Infected: Trojan-Downloader.Win32.VB.ah skipped
C:\WINDOWS\SYSTEM32\AST.exe WiseSFX: infected - 1 skipped
C:\WINDOWS\SYSTEM32\cult8b6q.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped
C:\WINDOWS\SYSTEM32\igfxsubs.dll Infected: Backdoor.Win32.PPdoor.bj skipped
C:\WINDOWS\SYSTEM32\sixpxe.dll Infected: Email-Worm.Win32.Tanatos.b.dam2 skipped
C:\WINDOWS\SYSTEM32\usrrcrt4.exe Infected: Backdoor.Win32.PPdoor.am skipped
C:\WINDOWS\SYSTEM32\usrvcprx.dll Infected: Backdoor.Win32.PPdoor.v skipped
C:\WINDOWS\SYSTEM32\zcdrdiq.dll Infected: Email-Worm.Win32.Tanatos.b.dam2 skipped
C:\WINDOWS\tchyrjh.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\telwopa.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\tmqgmgd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\tukanxu.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\tuvdwle.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ubrynxy.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\uimgneg.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\unast.exe/WISE0006.BIN Infected: Trojan-Downloader.Win32.VB.ah skipped
C:\WINDOWS\unast.exe WiseSFX: infected - 1 skipped
C:\WINDOWS\utwykbr.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\uvoaxjc.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\uxuhklc.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vclbhnd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vguqmrh.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vkiydfd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vmjnqva.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vmjqqjq.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vpyfjom.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vqopdnw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vrjpbnt.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vscidtr.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vvhherm.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\vxaogqj.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wapoyof.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wefxvvd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\weogswb.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\weqvrpo.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wfpmjje.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wgxrxsu.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wjghqbp.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wnoyadd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wtgokge.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wuuuerf.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\wwvrowd.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xbopxru.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xeduqjp.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xfcebag.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xnqilvl.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xnxpein.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xqamjom.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xqjwjse.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xtovbhv.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xvabras.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\xyqfbve.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ydgnhki.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ydifqne.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\yiukvxh.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ylewqhj.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ynhcwlh.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\yprgpbr.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\ysbdckt.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\yvstukv.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\yyjscdw.exe Infected: Trojan.Win32.Favadd.w skipped
C:\WINDOWS\yypfoob.exe Infected: Trojan.Win32.Favadd.w skipped

Scan process completed.

AboutBuster 6.0
Scan started on [2006-02-21] at [10:38:12]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
Removed Stream! C:\WINDOWS\Thumbs.db:encryptable
-------------------------------------------------------------
No Files Found!
-------------------------------------------------------------
Removed Temp Files
Internet Explorer Settings Reset!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 10:41:45

AboutBuster 6.0
Scan started on [2006-02-21] at [10:43:14]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
No Ads Found!
-------------------------------------------------------------
No Files Found!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 10:43:19

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 07:43:58, 2006-02-22
+ Report-Checksum: AA6949F2

+ Scan result:

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP840\A0119070.exe -> Adware.Broadcap : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP840\A0119072.exe -> Trojan.Starter.g : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP840\A0119073.exe -> Adware.Broadcap : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP840\A0119074.exe -> Adware.BookedSpace : Cleaned with backup

::Report End

sUBs · 02-22-2006, 03:09 PM

Please read this post completely before begining the fix.

Launch Outlook Express & empty the Deleted Items folder. (I'm assuming that Éléments supprimés means Deleted items)

* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * *

Right click on this & choose "Save As..." DelO15Domains.inf - DelO15Domains.inf
Right click on DelO15Domains.inf and choose Install. It will run immediately (you won't be able to see anything happen). You may delete the file afterwards.

SpywareBlaster 3.5.1
Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items

IE-SpyAD - Extract the contents to a new folder
From within the folder, double-click install.bat
Select Option #2 - Install the new IE-SPYAD list.
Then return to the main menu.
Select option #4 - Add the old porn sites domain

Download KillBox v2.0.0.175.exe (it's important that you get version v2.0.0.175)

* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * *

Do a HijackThis scan & place a check next to these items and select "Fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm

* * * * * * KILLBOX * * * * * * * * * * * * * * * * * * * * * * *

Launch KillBox.exe & select the following options:

delete on Reboot

All files (if available)

Use your mouse to select all the filenames highlighted in blue & then right-click & select Copy

C:\Program Files\Calendar Builder\clipartfree.exe
C:\WINDOWS\abtsrge.exe
C:\WINDOWS\ajbecll.exe
C:\WINDOWS\ajtgxjj.exe
C:\WINDOWS\akhrdjf.exe
C:\WINDOWS\astupgradecpr.exe
C:\WINDOWS\atdlpvj.exe
C:\WINDOWS\awtuxhq.exe
C:\WINDOWS\bbwsmin.exe
C:\WINDOWS\bgjytwd.exe
C:\WINDOWS\bgvrnkc.exe
C:\WINDOWS\bhiqsfn.exe
C:\WINDOWS\bihdigd.exe
C:\WINDOWS\bilxqqk.exe
C:\WINDOWS\blnjbed.exe
C:\WINDOWS\bnfsbli.exe
C:\WINDOWS\bpcdiex.exe
C:\WINDOWS\bptjjcf.exe
C:\WINDOWS\brjtllt.exe
C:\WINDOWS\bsxssde.exe
C:\WINDOWS\celbasy.exe
C:\WINDOWS\cevbhmx.exe
C:\WINDOWS\cswvgli.exe
C:\WINDOWS\ctymoar.exe
C:\WINDOWS\cyxolsy.exe
C:\WINDOWS\ddahevf.exe
C:\WINDOWS\dilhtyu.exe
C:\WINDOWS\dipgctp.exe
C:\WINDOWS\djssode.exe
C:\WINDOWS\doaoqra.exe
C:\WINDOWS\doseoay.exe
C:\WINDOWS\dqegeam.exe
C:\WINDOWS\drbyrve.exe
C:\WINDOWS\ealfxll.exe
C:\WINDOWS\ebqpwuk.exe
C:\WINDOWS\ecfcrqj.exe
C:\WINDOWS\ehpkkjt.exe
C:\WINDOWS\ejmiwbd.exe
C:\WINDOWS\enkpyeo.exe
C:\WINDOWS\epkrtth.exe
C:\WINDOWS\eptysct.exe
C:\WINDOWS\eukhutk.exe
C:\WINDOWS\exjacjn.exe
C:\WINDOWS\eyjukhl.exe
C:\WINDOWS\fcqeoox.exe
C:\WINDOWS\fdatwib.exe
C:\WINDOWS\fkohtaw.exe
C:\WINDOWS\fngplnc.exe
C:\WINDOWS\fodvqqf.exe
C:\WINDOWS\fptrdch.exe
C:\WINDOWS\fqmbbmm.exe
C:\WINDOWS\fqysdwu.exe
C:\WINDOWS\gmihnub.exe
C:\WINDOWS\gpwfjiq.exe
C:\WINDOWS\gwxsjnk.exe
C:\WINDOWS\hbvttqg.exe
C:\WINDOWS\hchghur.exe
C:\WINDOWS\heinekd.exe
C:\WINDOWS\hpjbska.exe
C:\WINDOWS\hwoyfsg.exe
C:\WINDOWS\ib.exe
C:\WINDOWS\idvdafo.exe
C:\WINDOWS\iqrjhhy.exe
C:\WINDOWS\isewobw.exe
C:\WINDOWS\ismkgls.exe
C:\WINDOWS\jhimlin.exe
C:\WINDOWS\jnelrbi.exe
C:\WINDOWS\jnhtvbu.exe
C:\WINDOWS\jnqoaxt.exe
C:\WINDOWS\jqnfufw.exe
C:\WINDOWS\jrkgpuc.exe
C:\WINDOWS\jryqhxk.exe
C:\WINDOWS\jtuuhiy.exe
C:\WINDOWS\jujiptg.exe
C:\WINDOWS\juwrjeq.exe
C:\WINDOWS\jvrrwsy.exe
C:\WINDOWS\kdheway.exe
C:\WINDOWS\kdkdyjl.exe
C:\WINDOWS\keksvya.exe
C:\WINDOWS\kncdgjq.exe
C:\WINDOWS\knyfcht.exe
C:\WINDOWS\kskvaxw.exe
C:\WINDOWS\kxqwwnv.exe
C:\WINDOWS\kytjkoc.exe
C:\WINDOWS\kyuvxjj.exe
C:\WINDOWS\ldsixkg.exe
C:\WINDOWS\lewqgdy.exe
C:\WINDOWS\ljsgacm.exe
C:\WINDOWS\lkqvgnc.exe
C:\WINDOWS\lksgohr.exe
C:\WINDOWS\lkxyrui.exe
C:\WINDOWS\loyfiao.exe
C:\WINDOWS\lrpigpi.exe
C:\WINDOWS\lymrqje.exe
C:\WINDOWS\mduikog.exe
C:\WINDOWS\mgvvlmj.exe
C:\WINDOWS\mnepfvy.exe
C:\WINDOWS\mnjxjcj.exe
C:\WINDOWS\mqirnyd.exe
C:\WINDOWS\mvjwcec.exe
C:\WINDOWS\ncgtnrv.exe
C:\WINDOWS\ndaqduy.exe
C:\WINDOWS\nftdvvf.exe
C:\WINDOWS\nhvglfm.exe
C:\WINDOWS\nmimhpn.exe
C:\WINDOWS\nsnijmv.exe
C:\WINDOWS\nwaiujy.exe
C:\WINDOWS\nwbnksy.exe
C:\WINDOWS\nylxxmd.exe
C:\WINDOWS\oasbfli.exe
C:\WINDOWS\obuoydo.exe
C:\WINDOWS\odcpwgu.exe
C:\WINDOWS\oewasym.exe
C:\WINDOWS\ojjfncm.exe
C:\WINDOWS\okaxeym.exe
C:\WINDOWS\omvbcij.exe
C:\WINDOWS\oqtnnnt.exe
C:\WINDOWS\papffbk.exe
C:\WINDOWS\patdjvu.exe
C:\WINDOWS\pauuqdd.exe
C:\WINDOWS\pbvfvcp.exe
C:\WINDOWS\pkyvnhp.exe
C:\WINDOWS\plwtdsf.exe
C:\WINDOWS\pmqyvwa.exe
C:\WINDOWS\pqwqbdp.exe
C:\WINDOWS\prmlbkm.exe
C:\WINDOWS\psepdyw.exe
C:\WINDOWS\pugaydt.exe
C:\WINDOWS\pvcgyss.exe
C:\WINDOWS\pvcrtsa.exe
C:\WINDOWS\qahvuvw.exe
C:\WINDOWS\qanrdvg.exe
C:\WINDOWS\qbieptm.exe
C:\WINDOWS\qdajoiv.exe
C:\WINDOWS\qenvkkl.exe
C:\WINDOWS\qevrlnf.exe
C:\WINDOWS\qkhpmda.exe
C:\WINDOWS\qugqrdg.exe
C:\WINDOWS\qvmpveh.exe
C:\WINDOWS\qvnnhar.exe
C:\WINDOWS\rfdsypg.exe
C:\WINDOWS\rhglmgu.exe
C:\WINDOWS\rldyiwv.exe
C:\WINDOWS\rlgxfsn.exe
C:\WINDOWS\rphywsw.exe
C:\WINDOWS\rpssrpa.exe
C:\WINDOWS\rukihya.exe
C:\WINDOWS\ruslkan.exe
C:\WINDOWS\rxbvggx.exe
C:\WINDOWS\SbCIe0261.dll
C:\WINDOWS\sgsuhmd.exe
C:\WINDOWS\sqohaqe.exe
C:\WINDOWS\srmjagq.exe
C:\WINDOWS\sruwfex.exe
C:\WINDOWS\supybas.exe
C:\WINDOWS\suqjdvp.exe
C:\WINDOWS\sydawws.exe
C:\WINDOWS\SYSTEM32\asncpvqq.exe
C:\WINDOWS\SYSTEM32\AST.exe
C:\WINDOWS\SYSTEM32\cult8b6q.ini
C:\WINDOWS\SYSTEM32\igfxsubs.dll
C:\WINDOWS\SYSTEM32\sixpxe.dll
C:\WINDOWS\SYSTEM32\usrrcrt4.exe
C:\WINDOWS\SYSTEM32\usrvcprx.dll
C:\WINDOWS\SYSTEM32\zcdrdiq.dll
C:\WINDOWS\tchyrjh.exe
C:\WINDOWS\telwopa.exe
C:\WINDOWS\tmqgmgd.exe
C:\WINDOWS\tukanxu.exe
C:\WINDOWS\tuvdwle.exe
C:\WINDOWS\ubrynxy.exe
C:\WINDOWS\uimgneg.exe
C:\WINDOWS\unast.exe
C:\WINDOWS\utwykbr.exe
C:\WINDOWS\uvoaxjc.exe
C:\WINDOWS\uxuhklc.exe
C:\WINDOWS\vclbhnd.exe
C:\WINDOWS\vguqmrh.exe
C:\WINDOWS\vkiydfd.exe
C:\WINDOWS\vmjnqva.exe
C:\WINDOWS\vmjqqjq.exe
C:\WINDOWS\vpyfjom.exe
C:\WINDOWS\vqopdnw.exe
C:\WINDOWS\vrjpbnt.exe
C:\WINDOWS\vscidtr.exe
C:\WINDOWS\vvhherm.exe
C:\WINDOWS\vxaogqj.exe
C:\WINDOWS\wapoyof.exe
C:\WINDOWS\wefxvvd.exe
C:\WINDOWS\weogswb.exe
C:\WINDOWS\weqvrpo.exe
C:\WINDOWS\wfpmjje.exe
C:\WINDOWS\wgxrxsu.exe
C:\WINDOWS\wjghqbp.exe
C:\WINDOWS\wnoyadd.exe
C:\WINDOWS\wtgokge.exe
C:\WINDOWS\wuuuerf.exe
C:\WINDOWS\wwvrowd.exe
C:\WINDOWS\xbopxru.exe
C:\WINDOWS\xeduqjp.exe
C:\WINDOWS\xfcebag.exe
C:\WINDOWS\xnqilvl.exe
C:\WINDOWS\xnxpein.exe
C:\WINDOWS\xqamjom.exe
C:\WINDOWS\xqjwjse.exe
C:\WINDOWS\xtovbhv.exe
C:\WINDOWS\xvabras.exe
C:\WINDOWS\xyqfbve.exe
C:\WINDOWS\ydgnhki.exe
C:\WINDOWS\ydifqne.exe
C:\WINDOWS\yiukvxh.exe
C:\WINDOWS\ylewqhj.exe
C:\WINDOWS\ynhcwlh.exe
C:\WINDOWS\yprgpbr.exe
C:\WINDOWS\ysbdckt.exe
C:\WINDOWS\yvstukv.exe
C:\WINDOWS\yyjscdw.exe
C:\WINDOWS\yypfoob.exe

* Go to the File menu, and choose Paste from Clipboard
* Click the RED X button.
* Click Yes at the Delete on Reboot prompt.
* Click Yes at the 'Pending Operations prompt'.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, download and run missingfilesetup.exe. Then try Killbox again.

* * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * *

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the option to run Windows in Safe Mode.

* * * * * * UN-INSTALLING PROGRAMS * * * * * * * * * * * * * *

Go to Start -> Control Panel -> Add or Remove Programs and uninstall the following programs:

Ftk \ FlashEnhance

Please note any other programs that you dont recognize in that list in your next response

* * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * *

If you have not done so already, please enable the viewing of Hidden files
From Windows Explorer, go to Tools -> Folder Options -> View tab.

Tick - 'Show hidden files and folder'
Untick - 'Hide file extensions for known types'
Untick - 'Hide protected operating system files'
Click Yes to confirm & then click OK

Locate and delete the following files/folders: (let me know if you fail to find/delete any)

C:\Program Files\Ftk

Delete the contents of this folder, leaving it empty:

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\

* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * *

Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider initially to Standard CleanUp!
3. Uncheck the following:

Delete Newsgroup cache
Delete Newsgroup Subscriptions
Scan local drives for temporary files

4. Click OK
5. Press the CleanUp! button to start the program.

* * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * *

This will empty the System Volume Information folder
Go to Start >> Run - type control sysdm.cpl,,4 & press Enter

Tick on the checkbox - Turn off System Restore on all drives
Click Apply

Turn it back 'On' by unticking the same checkbox & click OK

* * * * * *

Perform an online scan with Internet Explorer with Panda ActiveScan

Click Scan your PC & a 'pop up' window shall appear. *ensure that your pop up blocker doesn't block it
Click Scan Now
Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls

Begin the scan by selecting My Computer

If it finds any malware, it will offer you a report.
Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
Click on see report. Then click Save report

Post the contents of the report in your next reply

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan

After you have done that, please do another KAspersky online scan using the earlier settings.

* * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * *

In your next post, please include fresh logs from:

HiJackThis

Online scans

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

ybouch · 02-24-2006, 05:17 PM

Bonsoir,

UN-INSTALLING PROGRAMS

I didn't find: Ftk\FlashEnhance

Here are the logs.

HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 17:22:34, on 2006-02-24
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\NetAssistant\bin\mpbtn.exe
F:\Nettoyeurs de cochonneries\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://internet.videotron.ca/contrat
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Assistant Internet.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...92/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Friday, February 24, 2006 5:19:53 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 24/02/2006
Kaspersky Anti-Virus database records: 178427
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 116567
Number of viruses found: 1
Number of infected objects: 5
Number of suspicious objects: 0
Duration of the scan process: 01:01:01

Infected Object Name / Virus Name / Last Action
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED/quatrièmes.exe Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED/quatrièmes.exe Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx Mail MS Outlook 5: infected - 4 skipped

Scan process completed.

Incident Status Location

Spyware:spyware/whazit Not disinfected C:\WINDOWS\SYSTEM32\kyf.dat
Adware:adware/p2pnetworking Not disinfected C:\WINDOWS\SYSTEM32\P2P Networking v126.cpl
Adware:adware/keenvalue Not disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho
Adware:adware/findspy Not disinfected C:\Documents and Settings\Karoline\Favorites\ FREE Access to 800 Paid sites.url
Adware:adware/tvmedia Not disinfected C:\Documents and Settings\Karoline\Application Data\tvmknwrd.dll
Spyware:spyware/betterinet Not disinfected C:\WINDOWS\INF\biini.inf
Adware:adware/msview Not disinfected C:\WINDOWS\INF\MSView.inf
Adware:adware/bookedspace Not disinfected C:\WINDOWS\cfgmgr52.ini
Spyware:application/bestoffer Not disinfected C:\WINDOWS\smdat32m.sys
Adware:adware/broadcastpc Not disinfected C:\PROGRAM FILES\bpt
Adware:adware/sidesearch Not disinfected C:\PROGRAM FILES\Lycos
Adware:adware/ncase Not disinfected C:\WINDOWS\SYSTEM32\FLEOK
Adware:adware/topmoxie Not disinfected C:\WINDOWS\cache371
Adware:adware/flashtrack Not disinfected Windows Registry
Spyware:Spyware/BetterInet Not disinfected C:\WINDOWS\INF\biini.inf
Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\INF\flashtlk.inf
Adware:Adware/MSView Not disinfected C:\WINDOWS\INF\MSView.inf
Adware:Adware/StatBlaster Not disinfected C:\WINDOWS\SYSTEM32\O
Adware:Adware/P2PNetworking Not disinfected C:\WINDOWS\SYSTEM32\P2P Networking v126.cpl
Potentially unwanted tool:Application/Processor Not disinfected F:\Nettoyeurs de cochonneries\smitRem\smitRem\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected F:\Nettoyeurs de cochonneries\smitRem\smitRem.exe[Process.exe]
Virus:W32/Netsky.B.worm Disinfected Local Folders\Sent Items\Fw: hi\dinner.zip[dinner.htm.com]

And attachments

sUBs · 02-24-2006, 08:44 PM

Please uninstall these programs if present,

BroadcastPC

Lycos Search

Lycos Sidesearch

Then delete the following files/folders: (let me know if you fail to find/delete any)

C:\WINDOWS\SYSTEM32\kyf.dat
C:\WINDOWS\SYSTEM32\P2P Networking v126.cpl
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho
C:\Documents and Settings\Karoline\Favorites\FREE Access to 800 Paid sites.url
C:\Documents and Settings\Karoline\Application Data\tvmknwrd.dll
C:\WINDOWS\INF\biini.inf
C:\WINDOWS\INF\MSView.inf
C:\WINDOWS\cfgmgr52.ini
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\SYSTEM32\FLEOK
C:\WINDOWS\cache371
C:\WINDOWS\INF\biini.inf
C:\WINDOWS\INF\flashtlk.inf
C:\WINDOWS\SYSTEM32\O
C:\PROGRAM FILES\bpt
C:\PROGRAM FILES\Lycos

Let me know how your machine is behaving now

ybouch · 02-25-2006, 12:02 PM

Hi,

I didn't fin the programs: BroadcastPc
Lycos Search
Lycos Sidesearch

A new Kaspersky online scanner report shown the same virus and infected object.
See report:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Saturday, February 25, 2006 11:46:12 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 25/02/2006
Kaspersky Anti-Virus database records: 178587
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 116751
Number of viruses found: 1
Number of infected objects: 5
Number of suspicious objects: 0
Duration of the scan process: 01:00:07

Infected Object Name / Virus Name / Last Action
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED/quatrièmes.exe Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED/quatrièmes.exe Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED Infected: Email-Worm.Win32.Magistr.b skipped
C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx Mail MS Outlook 5: infected - 4 skipped

Scan process completed.

I deleted the infected object. Rebooted, closed antivirus and performed a new Kaspersky online scan.
The result was: No malware has been detected, the sections that have been scanned are clean.!!!!!!!!!!!!!!!

Here is the last Hijackthis.

Logfile of HijackThis v1.99.1
Scan saved at 13:59:41, on 2006-02-25
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
F:\Nettoyeurs de cochonneries\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://internet.videotron.ca/contrat
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Assistant Internet.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...92/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe

sUBs · 02-25-2006, 12:06 PM

Your system is clean. Kindly follow these simple steps in order to keep your computer clean and secure:

CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
- Tick on the checkbox - Turn off System Restore on all drives
- Click Apply
Turn it back 'On' by unticking the same checkbox & click OK
DISABLE THE VIEWING OF SYSTEM FILES
From Windows Explorer, go to Tools>Folder Options> View tab.
- Untick - Show hidden files and folder
- Tick - Hide file extensions for known types
- Tick - Hide protected operating system files
Click Yes to confirm & then click OK
SECURING INTERNET EXPLORER
From within Internet Explorer click on the Tools menu and then click on Internet Options.
- Select the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Select Custom Level .
    - Change 'Download signed ActiveX controls' to Prompt
    - Change 'Download unsigned ActiveX controls' to Disable
    - Change 'Initialize and script ActiveX controls not marked as safe' to Disable
    - Change 'Installation of desktop items' to Prompt
    - Change 'Launching programs and files in an IFRAME' to Prompt
    - Change 'Navigate sub-frames across different domains' to Prompt
    - When all these changes have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Select OK to exit the Internet Properties page.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
FIREWALL
Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.
Microsoft Windows Update
Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
SPYBOT - SEARCH & DESTROY
Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
AD-AWARE
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
Google Toolbar - Get the free google toolbar to help stop pop up windows.
CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.
Winpatrol - Download and install the free version of Winpatrol.
A tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.

ybouch · 02-26-2006, 12:41 PM

Bonjour,

I'm very impressed by the know-how of the team.

I'll recommand the forum to my friends.

Thanks!

02-17-2006, 10:40 AM	#1 (permalink)
ybouch Registered User Join Date: Feb 2006 Posts: 5 OS: XP	Error loading c:\windows\cfgmgr52.dll Hello to you all! When booting Windows XP, I always get this error message : Error loading c:\windows\cfgmgr52.dll. The specified module could not be found. Someone told me I had the Booked Space malware and gave me a procedure to get rid of it. Of course, a whole lot of garbage were removed, but not the one that still gives me the above error message. I updated my OS, ran AVG, then Ewido, Ad-Aware, Spybot and SpyBlaster (all in safe mode). I tried to run the built-in Sysclean task, but failed to perform. My HJT log is tremendously large and my computer so slow, I'm sure it is still infected with many unwanted programs. Would you check it out? PS: I'm not able to send the whole log. I cropped the log a bit so it can fit in this post. What I cut is more of the same. Logfile of HijackThis v1.99.1 Scan saved at 18:40:28, on 2006-02-16 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\DvzCommon\DvzMsgr.exe C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Palm\HOTSYNC.EXE G:\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://internet.videotron.ca/contrat R3 - URLSearchHook: (no name) - {576EE28D-1F4A-BA55-99EE-295D21D726CB} - C:\WINDOWS\hccztttl.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {D505AAEC-D1B6-EE4A-8CC6-08A770F2D084} - C:\WINDOWS\hccztttl.dll (file missing) O3 - Toolbar: Search - {8570F4E2-0EA1-7E20-480E-C465383548F3} - C:\WINDOWS\hccztttl.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [FtkCPY] "C:\Program Files\Common Files\Java\ftkcpy.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [xvelahc] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [ahbexrk] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [hqgsuvh] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [jilkmny] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [jgmfphc] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [uwvbkkc] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [tffqckj] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [vbvhnlp] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [xlyeixa] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [uauqwoq] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [xkqntit] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [bbyqoft] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [qyprxbr] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [xbytqws] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [dkrotvy] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [lgioinl] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [ubqghvo] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [chukxvb] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [rqgldmf] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [omfidfe] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [apwjhxb] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [yrsbxmv] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [nhrsuwy] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [qxxtluv] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [dqheuqc] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [adygxtw] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [kwgetkf] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [cxwyuoh] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [ppdbyug] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [bnsenje] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [cbujjca] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [uginrhi] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [ldfjnqm] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [ksmtxit] c:\windows\qmcocra.exe O4 - HKCU\..\Run: [yandrdq] c:\windows\aqaqfqd.exe O4 - HKCU\..\Run: [xevbdbt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ddpcncl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tsfvunk] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [qouuppr] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [iaarugi] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [bmhwaot] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [rluyxsh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [eveyhvb] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [mwnoxwl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [opjochf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [igevyxm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [delhmfe] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [nrvriny] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dlqbqqq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [owobyjn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dvpuysc] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [aqqsnve] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [yhajwkl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hanqxju] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tqdwknf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [kkbylqo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hgogsch] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [bitdlqm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wcecbah] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [mfhqojw] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ycowhbg] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [nsjuvmh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [eqlrabj] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ugtyqwx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vrepgpq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uqjvaur] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [muekrbt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dqaovbs] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fapnkmy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wbyokoq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [klxfhlw] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vsrhlpf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fnwgysu] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [erkovsp] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ntutfoi] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [migxcnj] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [jfxocaw] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uiuxumn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [atbkmxq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [yrfujfy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [usmdivy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gxejsrq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [bgfpgnl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gyxmcnt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [atwgaqq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ovjnssn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dcbsdve] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [sflmwff] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [aeghqdm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [avaauta] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [rgjushe] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [nppbpwk] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xbdsngv] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gpkskfb] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [khebabo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [csyqpgf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hytpxow] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [cpmyvmu] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [pggstng] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [oqoslla] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [shrgulj] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [posqqok] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xalrdms] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gddpbas] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [cfaaycu] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wifkcxb] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [kineugc] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ytrvket] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dabvtve] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gkiaqyv] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ihylura] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [pkwduew] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vdkhijb] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [rvafhws] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [heylotp] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [nbnvjdg] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wpaqdtj] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [mriiedl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uvnopjm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ycuympg] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [catgiwm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [lwuatoo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vydgxsn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ktemell] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tsuqije] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ktaunlf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [cawsknx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fxefqfr] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hefqcyh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uarahvh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [joksfdd] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wqmoqgs] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [lybupqy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xwsgotc] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hoschqq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [paucxym] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xchekun] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [jnwgefl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ljgnuhh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [qrwhrwt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [sctbyli] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [pbbinot] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dypgokr] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [sthcayi] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ogbmajq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [jsujgqp] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [khusnvp] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [oglvfrt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [kvjgdkv] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xeqiixx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wgxgawr] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hyrvmij] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tgseend] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tovvvsa] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xygujsi] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uaywcbf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [heqfqbl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [yvjehmf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gabpjlw] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [irwebgy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [cududwo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [mxtrvra] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hmpuphh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tysahna] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ebttury] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [sreqfla] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [njdgxuf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fjgfjbc] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [bpjwtys] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ymhtqgs] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fotdvdx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fktdsrm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xlhqpkn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vaecppq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ldiqbag] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [krxeedx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hnywtbo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [psincte] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [alnruel] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [orjukpq] c:\windows\jnqoaxt.exe O4 - HKCU\..\Run: [fthkimf] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [ijigetr] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [lsjhasq] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [oiffrto] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [njdgovm] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [shhhaxt] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [wufmxnt] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [ejnfknl] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [xpbptlh] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [usegrmf] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [cvmkcks] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [yrxdsot] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [ktuwaxm] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [fsxxopb] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [ecvjbqm] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [wdwaoxv] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [lxrgixs] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [ydqavmk] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [mqqidsf] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [qxremwh] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [bnnnadk] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [nndbtbj] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [vxamrey] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [ejskbot] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [nbewfbb] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [inykmbp] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [nqdxnlo] c:\windows\jvrrwsy.exe O4 - HKCU\..\Run: [xxuktin] c:\windows\jvrrwsy.exe O4 - HKCU\..\Run: [vmgxrva] c:\windows\jvrrwsy.exe O4 - HKCU\..\Run: [uftfkvy] c:\windows\jvrrwsy.exe O4 - HKCU\..\Run: [lctlmnd] c:\windows\kfjnotx.exe O4 - HKCU\..\Run: [dliteca] c:\windows\kfjnotx.exe O4 - HKCU\..\Run: [jeuyixb] c:\windows\kfjnotx.exe O4 - HKCU\..\Run: [HijackThis startup scan] G:\Hijackthis\HijackThis.exe /startupscan O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Quicken Scheduled Updates.lnk = ? O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Microsoft AntiSpyware helper - {3DC02A8F-7B62-4198-A8AB-1E5ED8668B16} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3DC02A8F-7B62-4198-A8AB-1E5ED8668B16} - (no file) (HKCU) O15 - Trusted Zone: .musicmatch.com O15 - Trusted Zone: .musicmatch.com (HKLM) O16 - DPF: {4BDEC07B-A230-2495-885C-029F2327607B} - http://66.117.37.5/1/rdgCA283.exe O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...92/mcfscan.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe

02-18-2006, 01:42 AM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,465 OS: N/A	Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. * * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * * Download & install - CleanUp.exe (not recommended for WinXP64) Download & extract it to it's own folder - About Buster.zip. Download & extract it to it's own folder - smitRem.exe You will need to update Ewido to the latest definition files. Launch Ewido & click Update from the left pane Then click on Start Update. If you are having problems with the updater, you can use this link to manually update Ewido When you have finished updating, EXIT Ewido. 'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. * * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * * Do a HijackThis scan & place a check next to these items and select "Fix checked": R3 - URLSearchHook: (no name) - {576EE28D-1F4A-BA55-99EE-295D21D726CB} - C:\WINDOWS\hccztttl.dll (file missing) O2 - BHO: (no name) - {D505AAEC-D1B6-EE4A-8CC6-08A770F2D084} - C:\WINDOWS\hccztttl.dll (file missing) O3 - Toolbar: Search - {8570F4E2-0EA1-7E20-480E-C465383548F3} - C:\WINDOWS\hccztttl.dll (file missing) O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [FtkCPY] "C:\Program Files\Common Files\Java\ftkcpy.exe" O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe" O4 - HKCU\..\Run: [xvelahc] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [ahbexrk] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [hqgsuvh] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [jilkmny] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [jgmfphc] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [uwvbkkc] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [tffqckj] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [vbvhnlp] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [xlyeixa] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [uauqwoq] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [xkqntit] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [bbyqoft] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [qyprxbr] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [xbytqws] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [dkrotvy] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [lgioinl] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [ubqghvo] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [chukxvb] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [rqgldmf] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [omfidfe] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [apwjhxb] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [yrsbxmv] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [nhrsuwy] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [qxxtluv] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [dqheuqc] c:\windows\xkljwos.exe O4 - HKCU\..\Run: [adygxtw] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [kwgetkf] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [cxwyuoh] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [ppdbyug] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [bnsenje] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [cbujjca] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [uginrhi] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [ldfjnqm] c:\windows\gqplexh.exe O4 - HKCU\..\Run: [ksmtxit] c:\windows\qmcocra.exe O4 - HKCU\..\Run: [yandrdq] c:\windows\aqaqfqd.exe O4 - HKCU\..\Run: [xevbdbt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ddpcncl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tsfvunk] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [qouuppr] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [iaarugi] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [bmhwaot] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [rluyxsh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [eveyhvb] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [mwnoxwl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [opjochf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [igevyxm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [delhmfe] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [nrvriny] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dlqbqqq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [owobyjn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dvpuysc] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [aqqsnve] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [yhajwkl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hanqxju] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tqdwknf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [kkbylqo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hgogsch] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [bitdlqm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wcecbah] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [mfhqojw] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ycowhbg] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [nsjuvmh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [eqlrabj] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ugtyqwx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vrepgpq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uqjvaur] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [muekrbt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dqaovbs] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fapnkmy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wbyokoq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [klxfhlw] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vsrhlpf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fnwgysu] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [erkovsp] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ntutfoi] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [migxcnj] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [jfxocaw] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uiuxumn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [atbkmxq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [yrfujfy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [usmdivy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gxejsrq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [bgfpgnl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gyxmcnt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [atwgaqq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ovjnssn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dcbsdve] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [sflmwff] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [aeghqdm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [avaauta] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [rgjushe] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [nppbpwk] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xbdsngv] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gpkskfb] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [khebabo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [csyqpgf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hytpxow] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [cpmyvmu] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [pggstng] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [oqoslla] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [shrgulj] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [posqqok] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xalrdms] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gddpbas] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [cfaaycu] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wifkcxb] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [kineugc] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ytrvket] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dabvtve] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gkiaqyv] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ihylura] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [pkwduew] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vdkhijb] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [rvafhws] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [heylotp] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [nbnvjdg] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wpaqdtj] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [mriiedl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uvnopjm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ycuympg] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [catgiwm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [lwuatoo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vydgxsn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ktemell] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tsuqije] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ktaunlf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [cawsknx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fxefqfr] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hefqcyh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uarahvh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [joksfdd] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wqmoqgs] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [lybupqy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xwsgotc] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hoschqq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [paucxym] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xchekun] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [jnwgefl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ljgnuhh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [qrwhrwt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [sctbyli] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [pbbinot] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [dypgokr] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [sthcayi] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ogbmajq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [jsujgqp] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [khusnvp] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [oglvfrt] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [kvjgdkv] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xeqiixx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [wgxgawr] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hyrvmij] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tgseend] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tovvvsa] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xygujsi] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [uaywcbf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [heqfqbl] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [yvjehmf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [gabpjlw] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [irwebgy] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [cududwo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [mxtrvra] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hmpuphh] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [tysahna] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ebttury] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [sreqfla] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [njdgxuf] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fjgfjbc] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [bpjwtys] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ymhtqgs] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fotdvdx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [fktdsrm] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [xlhqpkn] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [vaecppq] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [ldiqbag] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [krxeedx] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [hnywtbo] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [psincte] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [alnruel] c:\windows\jsakuyk.exe O4 - HKCU\..\Run: [orjukpq] c:\windows\jnqoaxt.exe O4 - HKCU\..\Run: [fthkimf] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [ijigetr] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [lsjhasq] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [oiffrto] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [njdgovm] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [shhhaxt] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [wufmxnt] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [ejnfknl] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [xpbptlh] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [usegrmf] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [cvmkcks] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [yrxdsot] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [ktuwaxm] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [fsxxopb] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [ecvjbqm] c:\windows\enkpyeo.exe O4 - HKCU\..\Run: [wdwaoxv] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [lxrgixs] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [ydqavmk] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [mqqidsf] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [qxremwh] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [bnnnadk] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [nndbtbj] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [vxamrey] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [ejskbot] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [nbewfbb] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [inykmbp] c:\windows\jryqhxk.exe O4 - HKCU\..\Run: [nqdxnlo] c:\windows\jvrrwsy.exe O4 - HKCU\..\Run: [xxuktin] c:\windows\jvrrwsy.exe O4 - HKCU\..\Run: [vmgxrva] c:\windows\jvrrwsy.exe O4 - HKCU\..\Run: [uftfkvy] c:\windows\jvrrwsy.exe O4 - HKCU\..\Run: [lctlmnd] c:\windows\kfjnotx.exe O4 - HKCU\..\Run: [dliteca] c:\windows\kfjnotx.exe O4 - HKCU\..\Run: [jeuyixb] c:\windows\kfjnotx.exe O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe O9 - Extra button: Microsoft AntiSpyware helper - {3DC02A8F-7B62-4198-A8AB-1E5ED8668B16} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3DC02A8F-7B62-4198-A8AB-1E5ED8668B16} - (no file) (HKCU) O15 - Trusted Zone: .musicmatch.com O15 - Trusted Zone: .musicmatch.com (HKLM) O16 - DPF: {4BDEC07B-A230-2495-885C-029F2327607B} - http://66.117.37.5/1/rdgCA283.exe * * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * * If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools -> Folder Options -> View tab. Tick - 'Show hidden files and folder' Untick - 'Hide file extensions for known types' Untick - 'Hide protected operating system files' Click Yes to confirm & then click OK Locate and delete the following files/folders: (let me know if you fail to find/delete any) C:\WINDOWS\System32\P2P Networking\ C:\Program Files\Security iGuard\ C:\WINDOWS\cfgmgr52.dll C:\Program Files\Common Files\Java\ftkcpy.exe c:\windows\xkljwos.exe c:\windows\gqplexh.exe c:\windows\aqaqfqd.exe c:\windows\jsakuyk.exe c:\windows\kfjnotx.exe C:\Program Files\Common Files\updater\ * * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following: Delete Newsgroup cache Delete Newsgroup Subscriptions Scan local drives for temporary files 4. Click OK 5. Press the CleanUp! button to start the program. 6. Do NOT reboot/logoff if prompted. * CleanUp! will not create any backups!! * * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * * Run About Buster and click - Begin Removal. Locate 'Ab LogFile.txt' (... in the same folder as AboutBuster) and post it in your next reply. * * * * Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply. * * * * Next go to Control Panel click Display>Desktop>Customize Desktop>Website Under the 'Web pages' box, Uncheck everything present. * * * * * Run Ewido with it's updated definitions:(...it's important that all windows must be closed) Click Scanner Click Complete System Scan to begin scanning. Click OK when prompted to clean files With the first file it prompts to clean, select the option: "Perform action on all infections" .Choose clean and click OK. Once finished, click the Save report button & save the report to your desktop ** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete. * * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * * Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan * * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh logs from: HiJackThis Smitfiles.txt Online scan About Buster Ewido Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Question - what have you done for the community today?

02-22-2006, 03:09 PM	#4 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,465 OS: N/A	Please read this post completely before begining the fix. Launch Outlook Express & empty the Deleted Items folder. (I'm assuming that Éléments supprimés means Deleted items) * * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * * Right click on this & choose "Save As..." DelO15Domains.inf - DelO15Domains.inf Right click on DelO15Domains.inf and choose Install. It will run immediately (you won't be able to see anything happen). You may delete the file afterwards. SpywareBlaster 3.5.1 Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items IE-SpyAD - Extract the contents to a new folder From within the folder, double-click install.bat Select Option #2 - Install the new IE-SPYAD list. Then return to the main menu. Select option #4 - Add the old porn sites domain Download KillBox v2.0.0.175.exe (it's important that you get version v2.0.0.175) * * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * * Do a HijackThis scan & place a check next to these items and select "Fix checked": R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm * * * * * * KILLBOX * * * * * * * * * * * * * * * * * * * * * * * Launch KillBox.exe & select the following options: delete on Reboot All files (if available) Use your mouse to select all the filenames highlighted in blue & then right-click & select Copy C:\Program Files\Calendar Builder\clipartfree.exe C:\WINDOWS\abtsrge.exe C:\WINDOWS\ajbecll.exe C:\WINDOWS\ajtgxjj.exe C:\WINDOWS\akhrdjf.exe C:\WINDOWS\astupgradecpr.exe C:\WINDOWS\atdlpvj.exe C:\WINDOWS\awtuxhq.exe C:\WINDOWS\bbwsmin.exe C:\WINDOWS\bgjytwd.exe C:\WINDOWS\bgvrnkc.exe C:\WINDOWS\bhiqsfn.exe C:\WINDOWS\bihdigd.exe C:\WINDOWS\bilxqqk.exe C:\WINDOWS\blnjbed.exe C:\WINDOWS\bnfsbli.exe C:\WINDOWS\bpcdiex.exe C:\WINDOWS\bptjjcf.exe C:\WINDOWS\brjtllt.exe C:\WINDOWS\bsxssde.exe C:\WINDOWS\celbasy.exe C:\WINDOWS\cevbhmx.exe C:\WINDOWS\cswvgli.exe C:\WINDOWS\ctymoar.exe C:\WINDOWS\cyxolsy.exe C:\WINDOWS\ddahevf.exe C:\WINDOWS\dilhtyu.exe C:\WINDOWS\dipgctp.exe C:\WINDOWS\djssode.exe C:\WINDOWS\doaoqra.exe C:\WINDOWS\doseoay.exe C:\WINDOWS\dqegeam.exe C:\WINDOWS\drbyrve.exe C:\WINDOWS\ealfxll.exe C:\WINDOWS\ebqpwuk.exe C:\WINDOWS\ecfcrqj.exe C:\WINDOWS\ehpkkjt.exe C:\WINDOWS\ejmiwbd.exe C:\WINDOWS\enkpyeo.exe C:\WINDOWS\epkrtth.exe C:\WINDOWS\eptysct.exe C:\WINDOWS\eukhutk.exe C:\WINDOWS\exjacjn.exe C:\WINDOWS\eyjukhl.exe C:\WINDOWS\fcqeoox.exe C:\WINDOWS\fdatwib.exe C:\WINDOWS\fkohtaw.exe C:\WINDOWS\fngplnc.exe C:\WINDOWS\fodvqqf.exe C:\WINDOWS\fptrdch.exe C:\WINDOWS\fqmbbmm.exe C:\WINDOWS\fqysdwu.exe C:\WINDOWS\gmihnub.exe C:\WINDOWS\gpwfjiq.exe C:\WINDOWS\gwxsjnk.exe C:\WINDOWS\hbvttqg.exe C:\WINDOWS\hchghur.exe C:\WINDOWS\heinekd.exe C:\WINDOWS\hpjbska.exe C:\WINDOWS\hwoyfsg.exe C:\WINDOWS\ib.exe C:\WINDOWS\idvdafo.exe C:\WINDOWS\iqrjhhy.exe C:\WINDOWS\isewobw.exe C:\WINDOWS\ismkgls.exe C:\WINDOWS\jhimlin.exe C:\WINDOWS\jnelrbi.exe C:\WINDOWS\jnhtvbu.exe C:\WINDOWS\jnqoaxt.exe C:\WINDOWS\jqnfufw.exe C:\WINDOWS\jrkgpuc.exe C:\WINDOWS\jryqhxk.exe C:\WINDOWS\jtuuhiy.exe C:\WINDOWS\jujiptg.exe C:\WINDOWS\juwrjeq.exe C:\WINDOWS\jvrrwsy.exe C:\WINDOWS\kdheway.exe C:\WINDOWS\kdkdyjl.exe C:\WINDOWS\keksvya.exe C:\WINDOWS\kncdgjq.exe C:\WINDOWS\knyfcht.exe C:\WINDOWS\kskvaxw.exe C:\WINDOWS\kxqwwnv.exe C:\WINDOWS\kytjkoc.exe C:\WINDOWS\kyuvxjj.exe C:\WINDOWS\ldsixkg.exe C:\WINDOWS\lewqgdy.exe C:\WINDOWS\ljsgacm.exe C:\WINDOWS\lkqvgnc.exe C:\WINDOWS\lksgohr.exe C:\WINDOWS\lkxyrui.exe C:\WINDOWS\loyfiao.exe C:\WINDOWS\lrpigpi.exe C:\WINDOWS\lymrqje.exe C:\WINDOWS\mduikog.exe C:\WINDOWS\mgvvlmj.exe C:\WINDOWS\mnepfvy.exe C:\WINDOWS\mnjxjcj.exe C:\WINDOWS\mqirnyd.exe C:\WINDOWS\mvjwcec.exe C:\WINDOWS\ncgtnrv.exe C:\WINDOWS\ndaqduy.exe C:\WINDOWS\nftdvvf.exe C:\WINDOWS\nhvglfm.exe C:\WINDOWS\nmimhpn.exe C:\WINDOWS\nsnijmv.exe C:\WINDOWS\nwaiujy.exe C:\WINDOWS\nwbnksy.exe C:\WINDOWS\nylxxmd.exe C:\WINDOWS\oasbfli.exe C:\WINDOWS\obuoydo.exe C:\WINDOWS\odcpwgu.exe C:\WINDOWS\oewasym.exe C:\WINDOWS\ojjfncm.exe C:\WINDOWS\okaxeym.exe C:\WINDOWS\omvbcij.exe C:\WINDOWS\oqtnnnt.exe C:\WINDOWS\papffbk.exe C:\WINDOWS\patdjvu.exe C:\WINDOWS\pauuqdd.exe C:\WINDOWS\pbvfvcp.exe C:\WINDOWS\pkyvnhp.exe C:\WINDOWS\plwtdsf.exe C:\WINDOWS\pmqyvwa.exe C:\WINDOWS\pqwqbdp.exe C:\WINDOWS\prmlbkm.exe C:\WINDOWS\psepdyw.exe C:\WINDOWS\pugaydt.exe C:\WINDOWS\pvcgyss.exe C:\WINDOWS\pvcrtsa.exe C:\WINDOWS\qahvuvw.exe C:\WINDOWS\qanrdvg.exe C:\WINDOWS\qbieptm.exe C:\WINDOWS\qdajoiv.exe C:\WINDOWS\qenvkkl.exe C:\WINDOWS\qevrlnf.exe C:\WINDOWS\qkhpmda.exe C:\WINDOWS\qugqrdg.exe C:\WINDOWS\qvmpveh.exe C:\WINDOWS\qvnnhar.exe C:\WINDOWS\rfdsypg.exe C:\WINDOWS\rhglmgu.exe C:\WINDOWS\rldyiwv.exe C:\WINDOWS\rlgxfsn.exe C:\WINDOWS\rphywsw.exe C:\WINDOWS\rpssrpa.exe C:\WINDOWS\rukihya.exe C:\WINDOWS\ruslkan.exe C:\WINDOWS\rxbvggx.exe C:\WINDOWS\SbCIe0261.dll C:\WINDOWS\sgsuhmd.exe C:\WINDOWS\sqohaqe.exe C:\WINDOWS\srmjagq.exe C:\WINDOWS\sruwfex.exe C:\WINDOWS\supybas.exe C:\WINDOWS\suqjdvp.exe C:\WINDOWS\sydawws.exe C:\WINDOWS\SYSTEM32\asncpvqq.exe C:\WINDOWS\SYSTEM32\AST.exe C:\WINDOWS\SYSTEM32\cult8b6q.ini C:\WINDOWS\SYSTEM32\igfxsubs.dll C:\WINDOWS\SYSTEM32\sixpxe.dll C:\WINDOWS\SYSTEM32\usrrcrt4.exe C:\WINDOWS\SYSTEM32\usrvcprx.dll C:\WINDOWS\SYSTEM32\zcdrdiq.dll C:\WINDOWS\tchyrjh.exe C:\WINDOWS\telwopa.exe C:\WINDOWS\tmqgmgd.exe C:\WINDOWS\tukanxu.exe C:\WINDOWS\tuvdwle.exe C:\WINDOWS\ubrynxy.exe C:\WINDOWS\uimgneg.exe C:\WINDOWS\unast.exe C:\WINDOWS\utwykbr.exe C:\WINDOWS\uvoaxjc.exe C:\WINDOWS\uxuhklc.exe C:\WINDOWS\vclbhnd.exe C:\WINDOWS\vguqmrh.exe C:\WINDOWS\vkiydfd.exe C:\WINDOWS\vmjnqva.exe C:\WINDOWS\vmjqqjq.exe C:\WINDOWS\vpyfjom.exe C:\WINDOWS\vqopdnw.exe C:\WINDOWS\vrjpbnt.exe C:\WINDOWS\vscidtr.exe C:\WINDOWS\vvhherm.exe C:\WINDOWS\vxaogqj.exe C:\WINDOWS\wapoyof.exe C:\WINDOWS\wefxvvd.exe C:\WINDOWS\weogswb.exe C:\WINDOWS\weqvrpo.exe C:\WINDOWS\wfpmjje.exe C:\WINDOWS\wgxrxsu.exe C:\WINDOWS\wjghqbp.exe C:\WINDOWS\wnoyadd.exe C:\WINDOWS\wtgokge.exe C:\WINDOWS\wuuuerf.exe C:\WINDOWS\wwvrowd.exe C:\WINDOWS\xbopxru.exe C:\WINDOWS\xeduqjp.exe C:\WINDOWS\xfcebag.exe C:\WINDOWS\xnqilvl.exe C:\WINDOWS\xnxpein.exe C:\WINDOWS\xqamjom.exe C:\WINDOWS\xqjwjse.exe C:\WINDOWS\xtovbhv.exe C:\WINDOWS\xvabras.exe C:\WINDOWS\xyqfbve.exe C:\WINDOWS\ydgnhki.exe C:\WINDOWS\ydifqne.exe C:\WINDOWS\yiukvxh.exe C:\WINDOWS\ylewqhj.exe C:\WINDOWS\ynhcwlh.exe C:\WINDOWS\yprgpbr.exe C:\WINDOWS\ysbdckt.exe C:\WINDOWS\yvstukv.exe C:\WINDOWS\yyjscdw.exe C:\WINDOWS\yypfoob.exe * Go to the File menu, and choose Paste from Clipboard * Click the RED X button. * Click Yes at the Delete on Reboot prompt. * Click Yes at the 'Pending Operations prompt'. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, download and run missingfilesetup.exe. Then try Killbox again. * * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * UN-INSTALLING PROGRAMS * * * * * * * * * * * * * * Go to Start -> Control Panel -> Add or Remove Programs and uninstall the following programs: Ftk \ FlashEnhance Please note any other programs that you dont recognize in that list in your next response * * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * * If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools -> Folder Options -> View tab. Tick - 'Show hidden files and folder' Untick - 'Hide file extensions for known types' Untick - 'Hide protected operating system files' Click Yes to confirm & then click OK Locate and delete the following files/folders: (let me know if you fail to find/delete any) C:\Program Files\Ftk Delete the contents of this folder, leaving it empty: C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ * * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following: Delete Newsgroup cache Delete Newsgroup Subscriptions Scan local drives for temporary files 4. Click OK 5. Press the CleanUp! button to start the program. * * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * * This will empty the System Volume Information folder Go to Start >> Run - type control sysdm.cpl,,4 & press Enter Tick on the checkbox - Turn off System Restore on all drives Click Apply Turn it back 'On' by unticking the same checkbox & click OK * * * * * * Perform an online scan with Internet Explorer with Panda ActiveScan Click Scan your PC & a 'pop up' window shall appear. ensure that your pop up blocker doesn't block it Click Scan Now* Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls Begin the scan by selecting My Computer If it finds any malware, it will offer you a report. Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later. Click on see report. Then click Save report Post the contents of the report in your next reply You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. Turn off the real time scanner of any existing antivirus program while performing the online scan After you have done that, please do another KAspersky online scan using the earlier settings. * * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh logs from: HiJackThis Online scans Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Question - what have you done for the community today?

02-24-2006, 08:44 PM	#6 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,465 OS: N/A	Please uninstall these programs if present, BroadcastPC Lycos Search Lycos Sidesearch Then delete the following files/folders: (let me know if you fail to find/delete any) C:\WINDOWS\SYSTEM32\kyf.dat C:\WINDOWS\SYSTEM32\P2P Networking v126.cpl C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho C:\Documents and Settings\Karoline\Favorites\FREE Access to 800 Paid sites.url C:\Documents and Settings\Karoline\Application Data\tvmknwrd.dll C:\WINDOWS\INF\biini.inf C:\WINDOWS\INF\MSView.inf C:\WINDOWS\cfgmgr52.ini C:\WINDOWS\smdat32m.sys C:\WINDOWS\SYSTEM32\FLEOK C:\WINDOWS\cache371 C:\WINDOWS\INF\biini.inf C:\WINDOWS\INF\flashtlk.inf C:\WINDOWS\SYSTEM32\O C:\PROGRAM FILES\bpt C:\PROGRAM FILES\Lycos Let me know how your machine is behaving now __________________ Question - what have you done for the community today?

02-25-2006, 12:02 PM	#7 (permalink)
ybouch Registered User Join Date: Feb 2006 Posts: 5 OS: XP	My computer seen to be clean Hi, I didn't fin the programs: BroadcastPc Lycos Search Lycos Sidesearch A new Kaspersky online scanner report shown the same virus and infected object. See report: ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Saturday, February 25, 2006 11:46:12 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600) Kaspersky On-line Scanner version: 5.0.78.0 Kaspersky Anti-Virus database last update: 25/02/2006 Kaspersky Anti-Virus database records: 178587 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 116751 Number of viruses found: 1 Number of infected objects: 5 Number of suspicious objects: 0 Duration of the scan process: 01:00:07 Infected Object Name / Virus Name / Last Action C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED/quatrièmes.exe Infected: Email-Worm.Win32.Magistr.b skipped C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED Infected: Email-Worm.Win32.Magistr.b skipped C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED/quatrièmes.exe Infected: Email-Worm.Win32.Magistr.b skipped C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx/[From +++++++++++ =?ISO-8859-1?Q?Gigu=E8re?=][Date Date header was inserted by VL-MS-MR001.sc1.videotron.ca]/UNNAMED Infected: Email-Worm.Win32.Magistr.b skipped C:\DELL\Application Data\Identities\{A9AE8560-1BF6-11D6-A5B5-00909614B0CD}\Microsoft\Outlook Express\Éléments supprimés.dbx Mail MS Outlook 5: infected - 4 skipped Scan process completed. I deleted the infected object. Rebooted, closed antivirus and performed a new Kaspersky online scan. The result was: No malware has been detected, the sections that have been scanned are clean.!!!!!!!!!!!!!!! Here is the last Hijackthis. Logfile of HijackThis v1.99.1 Scan saved at 13:59:41, on 2006-02-25 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\ctfmon.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\DvzCommon\DvzMsgr.exe C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Palm\HOTSYNC.EXE C:\Program Files\NetAssistant\bin\mpbtn.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE F:\Nettoyeurs de cochonneries\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://internet.videotron.ca/contrat R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Assistant Internet.lnk = C:\Program Files\NetAssistant\bin\matcli.exe O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Quicken Scheduled Updates.lnk = ? O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...92/mcfscan.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Enlèvement de cochonnneries\Ewido\security suite\ewidoctrl.exe

02-25-2006, 12:06 PM	#8 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,465 OS: N/A	Your system is clean. Kindly follow these simple steps in order to keep your computer clean and secure: CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder) Go to Start >> Run - type control sysdm.cpl,,4 & press Enter Tick on the checkbox - Turn off System Restore on all drives Click Apply Turn it back 'On' by unticking the same checkbox & click OK DISABLE THE VIEWING OF SYSTEM FILES From Windows Explorer, go to Tools>Folder Options> View tab. Untick - Show hidden files and folder Tick - Hide file extensions for known types Tick - Hide protected operating system files Click Yes to confirm & then click OK SECURING INTERNET EXPLORER From within Internet Explorer click on the Tools menu and then click on Internet Options. Select the Security tab Click once on the Internet icon so it becomes highlighted. Select Custom Level . Change 'Download signed ActiveX controls' to Prompt Change 'Download unsigned ActiveX controls' to Disable Change 'Initialize and script ActiveX controls not marked as safe' to Disable Change 'Installation of desktop items' to Prompt Change 'Launching programs and files in an IFRAME' to Prompt Change 'Navigate sub-frames across different domains' to Prompt When all these changes have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Select OK to exit the Internet Properties page. ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online & their stand-alone antivirus programs: Virus, Spyware, and Malware Protection and Removal Resources It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. FIREWALL Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here. Microsoft Windows Update Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here AD-AWARE Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety. Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness. Sun's Java - It's much more secure than Microsoft's Java Virtual Machine. Google Toolbar - Get the free google toolbar to help stop pop up windows. CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT. ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry. NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster. Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer from malicious software To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Question - what have you done for the community today?

02-26-2006, 12:41 PM	#9 (permalink)
ybouch Registered User Join Date: Feb 2006 Posts: 5 OS: XP	System clean Bonjour, I'm very impressed by the know-how of the team. I'll recommand the forum to my friends. Thanks!