Problems with ADWARE.LOP(RESOLVED)

  1. #11
    Crazy_angler is offline Newbie

    Re: Problems with ADWARE.LOP

    Hi,
    I've done all that and copied the session log and a ne HJT log below....Thanks

    ********
    18:12: | Start of Session, 26 March 2006 |
    18:12: Spy Sweeper started
    18:12: Sweep initiated using definitions version 641
    18:12: Starting Memory Sweep
    18:17: Memory Sweep Complete, Elapsed Time: 00:04:39
    18:17: Starting Registry Sweep
    18:17: Found Adware: blazefind
    18:17: HKCR\clsid\{1e432263-6841-4653-8f02-366a2f77e339}\ (11 subtraces) (ID = 104440)
    18:17: HKCR\clsid\{a1dd937d-71e1-4bb5-bd5d-1b01b9cb1c2f}\ (11 subtraces) (ID = 104453)
    18:17: HKLM\software\classes\clsid\{1e432263-6841-4653-8f02-366a2f77e339}\ (11 subtraces) (ID = 104473)
    18:17: HKLM\software\classes\clsid\{a1dd937d-71e1-4bb5-bd5d-1b01b9cb1c2f}\ (11 subtraces) (ID = 104485)
    18:17: HKLM\software\classes\windowssb.autosearch.1\ (3 subtraces) (ID = 104505)
    18:17: HKLM\software\classes\windowssb.autosearch\ (5 subtraces) (ID = 104506)
    18:17: HKLM\software\microsoft\windows\currentversion\uni nstall\windows sr 2.0\ (4 subtraces) (ID = 104552)
    18:17: HKCR\windowssb.autosearch.1\ (3 subtraces) (ID = 104571)
    18:17: HKCR\windowssb.autosearch\ (5 subtraces) (ID = 104572)
    18:18: Found Adware: sidesearch
    18:18: HKU\S-1-5-21-1123561945-790525478-839522115-1003\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
    18:18: Registry Sweep Complete, Elapsed Time:00:00:33
    18:18: Starting Cookie Sweep
    18:18: Found Spy Cookie: touchclarity cookie
    18:18: linda@easyjet.touchclarity[1].txt (ID = 3566)
    18:18: Found Spy Cookie: 123count cookie
    18:18: mark@123count[1].txt (ID = 1927)
    18:18: Found Spy Cookie: 2o7.net cookie
    18:18: mark@2o7[1].txt (ID = 1957)
    18:18: Found Spy Cookie: about cookie
    18:18: mark@about[2].txt (ID = 2037)
    18:18: Found Spy Cookie: affiliate cookie
    18:18: mark@affiliate[1].txt (ID = 2199)
    18:18: Found Spy Cookie: ask cookie
    18:18: mark@ask[1].txt (ID = 2245)
    18:18: Found Spy Cookie: atlas dmt cookie
    18:18: mark@atdmt[2].txt (ID = 2253)
    18:18: mark@barclays.touchclarity[1].txt (ID = 3566)
    18:18: Found Spy Cookie: bilbo.counted.com cookie
    18:18: mark@bilbo.counted[2].txt (ID = 2306)
    18:18: Found Spy Cookie: bizrate cookie
    18:18: mark@bizrate[1].txt (ID = 2308)
    18:18: Found Spy Cookie: bravenet cookie
    18:18: mark@bravenet[1].txt (ID = 2322)
    18:18: Found Spy Cookie: btgrab cookie
    18:18: mark@btg.btgrab[2].txt (ID = 2333)
    18:18: mark@btow.touchclarity[1].txt (ID = 3566)
    18:18: Found Spy Cookie: ccbill cookie
    18:18: mark@ccbill[2].txt (ID = 2369)
    18:18: Found Spy Cookie: coremetrics cookie
    18:18: mark@data.coremetrics[1].txt (ID = 2472)
    18:18: Found Spy Cookie: dealtime cookie
    18:18: mark@dealtime[1].txt (ID = 2505)
    18:18: Found Spy Cookie: desktop kazaa cookie
    18:18: mark@desktop.kazaa[1].txt (ID = 2515)
    18:18: mark@easyjet.touchclarity[1].txt (ID = 3566)
    18:18: mark@experts.about[2].txt (ID = 2038)
    18:18: Found Spy Cookie: fastclick cookie
    18:18: mark@fastclick[1].txt (ID = 2651)
    18:18: mark@firstdirect.touchclarity[1].txt (ID = 3566)
    18:18: mark@ford.touchclarity[1].txt (ID = 3566)
    18:18: Found Spy Cookie: go2net.com cookie
    18:18: mark@go2net[1].txt (ID = 2730)
    18:18: Found Spy Cookie: go.com cookie
    18:18: mark@go[1].txt (ID = 2728)
    18:18: mark@hinduism.about[2].txt (ID = 2038)
    18:18: Found Spy Cookie: jp18 cookie
    18:18: mark@jp18[2].txt (ID = 2891)
    18:18: Found Spy Cookie: kinghost cookie
    18:18: mark@kinghost[1].txt (ID = 2903)
    18:18: Found Spy Cookie: monstermarketplace cookie
    18:18: mark@monstermarketplace[1].txt (ID = 3006)
    18:18: mark@msn.touchclarity[1].txt (ID = 3566)
    18:18: Found Spy Cookie: offeroptimizer cookie
    18:18: mark@offeroptimizer[1].txt (ID = 3087)
    18:18: Found Spy Cookie: pricegrabber cookie
    18:18: mark@pcworld.pricegrabber[1].txt (ID = 3186)
    18:18: mark@pricegrabber[1].txt (ID = 3185)
    18:18: mark@renault.touchclarity[1].txt (ID = 3566)
    18:18: mark@stat.dealtime[2].txt (ID = 2506)
    18:18: Found Spy Cookie: clicktracks cookie
    18:18: mark@stats2.clicktracks[1].txt (ID = 2407)
    18:18: mark@theaa.touchclarity[1].txt (ID = 3566)
    18:18: Found Spy Cookie: toplist cookie
    18:18: mark@toplist[2].txt (ID = 3557)
    18:18: Found Spy Cookie: tracking cookie
    18:18: mark@tracking[2].txt (ID = 3571)
    18:18: mark@uk.ask[1].txt (ID = 2246)
    18:18: mark@uswitch.touchclarity[1].txt (ID = 3566)
    18:18: mark@video.movies.go[1].txt (ID = 2729)
    18:18: mark@www.jp18[2].txt (ID = 2892)
    18:18: Found Spy Cookie: teenax cookie
    18:18: mark@www.teenax[1].txt (ID = 3504)
    18:18: Found Spy Cookie: xiti cookie
    18:18: mark@xiti[1].txt (ID = 3717)
    18:18: Cookie Sweep Complete, Elapsed Time: 00:00:09
    18:18: Starting File Sweep
    18:18: c:\program files\windowssa (1 subtraces) (ID = -2147481364)
    18:18: c:\program files\windupdates (ID = -2147481362)
    18:18: c:\program files\lycos\sidesearch (1 subtraces) (ID = -2147480322)
    18:18: Found Adware: bullguard popup ad
    18:18: c:\windows\temp\bullguard (1 subtraces) (ID = -2147476409)
    18:18: Found Adware: cydoor peer-to-peer dependency
    18:18: cd_clint.dll (ID = 57300)
    18:26: winsb.dll (ID = 51520)
    18:48: bulldownload.exe (ID = 52017)
    18:49: Warning: Could not get layout for drive G:. Incorrect function
    18:51: Found System Monitor: potentially rootkit-masked files
    18:51: 00000528. (ID = 0)
    19:01: Warning: Unhandled Archive Type
    19:01: Warning: Unhandled Archive Type
    19:02: Warning: Invalid file - not a PKZip file
    19:03: File Sweep Complete, Elapsed Time: 00:45:00
    19:03: Full Sweep has completed. Elapsed time 00:50:29
    19:03: Traces Found: 129
    19:58: Removal process initiated
    19:58: Quarantining All Traces: potentially rootkit-masked files
    19:58: potentially rootkit-masked files is in use. It will be removed on reboot.
    19:58: 00000528. is in use. It will be removed on reboot.
    19:58: Quarantining All Traces: blazefind
    19:58: Quarantining All Traces: sidesearch
    19:58: Quarantining All Traces: bullguard popup ad
    19:59: Quarantining All Traces: cydoor peer-to-peer dependency
    19:59: Quarantining All Traces: 123count cookie
    19:59: Quarantining All Traces: 2o7.net cookie
    19:59: Quarantining All Traces: about cookie
    19:59: Quarantining All Traces: affiliate cookie
    19:59: Quarantining All Traces: ask cookie
    19:59: Quarantining All Traces: atlas dmt cookie
    19:59: Quarantining All Traces: bilbo.counted.com cookie
    19:59: Quarantining All Traces: bizrate cookie
    19:59: Quarantining All Traces: bravenet cookie
    19:59: Quarantining All Traces: btgrab cookie
    19:59: Quarantining All Traces: ccbill cookie
    19:59: Quarantining All Traces: clicktracks cookie
    19:59: Quarantining All Traces: coremetrics cookie
    19:59: Quarantining All Traces: dealtime cookie
    19:59: Quarantining All Traces: desktop kazaa cookie
    19:59: Quarantining All Traces: fastclick cookie
    19:59: Quarantining All Traces: go.com cookie
    19:59: Quarantining All Traces: go2net.com cookie
    19:59: Quarantining All Traces: jp18 cookie
    19:59: Quarantining All Traces: kinghost cookie
    19:59: Quarantining All Traces: monstermarketplace cookie
    19:59: Quarantining All Traces: offeroptimizer cookie
    19:59: Quarantining All Traces: pricegrabber cookie
    19:59: Quarantining All Traces: teenax cookie
    19:59: Quarantining All Traces: toplist cookie
    19:59: Quarantining All Traces: touchclarity cookie
    19:59: Quarantining All Traces: tracking cookie
    19:59: Quarantining All Traces: xiti cookie
    19:59: Removal process completed. Elapsed time 00:00:52
    ********
    18:10: | Start of Session, 26 March 2006 |
    18:10: Spy Sweeper started
    18:11: Your spyware definitions have been updated.
    18:12: | End of Session, 26 March 2006 |

    ************************************************** ****************

    Logfile of HijackThis v1.99.1
    Scan saved at 20:03:46, on 26/03/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F 1.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\AOpen\SilentTekV5\Lite.EXE
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\mgabg.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
    C:\Program Files\Vista\vsys\bin\vacc_server.exe
    C:\Program Files\Vista\vsys\bin\vczar_server.exe
    C:\Program Files\Vista\vsys\bin\vlog_server.exe
    C:\Program Files\Vista\vsys\bin\vls_server.exe
    C:\Program Files\Vista\vsys\bin\vsq_server.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    C:\Downloads\Spy\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.co.uk/ws/eBayISAPI.dl...grateVisitor=3
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F 1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SilentTek] C:\Program Files\AOpen\SilentTekV5\Lite.EXE
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: VPN Client.lnk = ?
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-36.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.co.uk/downlo...1/axofupld.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {9B6D0E46-3F96-11D9-A711-004F4E099F85} (Originality.WEBnewszine) - http://www.webnewszinecontent.co.uk/...EBnewszine.CAB
    O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462...l/SymDlBrg.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
    O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex...l_v1-0-3-0.cab
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
    O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\System32\mgabg.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: VSystem Vaccess Server (vacc_server) - Unknown owner - C:\Program Files\Vista\vsys\bin\vacc_server.exe
    O23 - Service: Vsystem Vczar Server (vczar_server) - Unknown owner - C:\Program Files\Vista\vsys\bin\vczar_server.exe
    O23 - Service: Vsystem Vlog Server (vlog_server) - Unknown owner - C:\Program Files\Vista\vsys\bin\vlog_server.exe
    O23 - Service: Vsystem License Server (vls_server) - Unknown owner - C:\Program Files\Vista\vsys\bin\vls_server.exe
    O23 - Service: Vsystem Vscript Server (vsq_server) - Unknown owner - C:\Program Files\Vista\vsys\bin\vsq_server.exe


  2. #12
    Neal is offline Dedicated Member
    Hi,

    Your log is clean, how is it behaving now?

  3. #13
    Crazy_angler is offline Newbie
    Hi,
    It looks good - the IE home page is remaining set to what I last set it to, and I'm not getting any warnings about ADWARE.LOP.

    Many Thanks.....

  4. #14
    Neal is offline Dedicated Member
    Save 20% on AVG Internet Security 2012 Suite!
    okey dokey, thanks for stopping by.



    If you are no longer having any more trouble here is some preventative measures for you.

    Here are some preventive measures you can take to keep your computer from getting infected again. also keep all these and Ad-awareSE and SpybotS&D updated.

    http://forums.thatcomputerguy.us/ind...showtopic=1190

    Flush your restore points in ME and XP, by turning System Restore off and then back on.
    This will create a fresh restore point.

    Explained here:
    Windows XP: service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

    Microsoft ME:

    http://service1.symantec.com/SUPPORT...rc=sec_doc_nam


    RegProtect

    This small registry protection tool will save you hours of heartache by notifying you when some program good or bad is trying to access your registry.

    You have the option of allowing(good) items or blocking(bad)items.

    http://www.diamondcs.com.au/index.php?page=regprot


    To reduce the re-infection potential for malware and protect yourself against spyware, here are a few helpful suggestions:

    1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft. This will patch many of the security holes through which attackers can gain access to your computer. You CANNOT complete this update using an alternate browser.
    http://v5.windowsupdate.microsoft.co....aspx?ln=en-us

    http://www.microsoft.com/windows/ie/default.asp


    2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching, there are a some good free Antivirus programs that are decent, including AVG and Avast!.
    AVG: http://free.grisoft.com/doc/1

    Avast: http://www.avast.com/eng/avast_4_home.html


    3. In addtion to using Ad-aware consider using another free malware scanning/removal program:
    MS Antispyware beta: http://www.microsoft.com/athome/secu...e/default.mspx


    4. Consider using a free firewall if you are not already using one. Some good free ones are:
    Kerio
    http://www.sunbelt-software.com/Kerio.cfm

    OutPost Personal Firewall:
    Outpost



    5. Consider using an alternate free browser for general web surfing but you must use IE for windows update.
    Mozilla Firefox: www.mozilla.org/products/firefox/


    6. Consider increasing your browser security by using these programs:
    SpywareGuard will protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html
    SpywareBlaster will increase browser protection by blocking Thousands of known malware sites by adding them to IE's restricted sites zone. Download it here:

    http://www.javacoolsoftware.com/spywareblaster.html


    If you use SpywareBlaster, you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/


    IE-SPYAD is similar in that it adds thousands more known malware sites to IE's restricted zone. Download it here:
    https://netfiles.uiuc.edu/ehowes/www/resource.htm


    *Remember just like your primary anti-virus software, it is important to keep all of these programs up-to-date and use them on a regular basis. It's Free

+ Reply to Thread
Page 2 of 2 FirstFirst 1 2