Internet browser keeps re-directing! HJT Log

  1. #1
    ashstars is offline Newbie

    Internet browser keeps re-directing! HJT Log

    *I ran spy bot and ad-aware, which both found a LOT of tracking cookies. I ran AVG ant-virus which found 2 trojan infections. My web browser keeps re-directing me to other search pages including porn pages. grrr. Any help would be VERY appreciated!!




    Logfile of HijackThis v1.99.1
    Scan saved at 11:17:55 PM, on 8/31/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
    C:\Program Files\Lexmark 7100 Series\ezprint.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\Common Files\AOL\1179861557\ee\AOLSoftware.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\lxbxcoms.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Live Toolbar\msn_sl.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtim e.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
    O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
    O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7100 Series\ezprint.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1179861557\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?26c0e173b3944ce2874accbc3ca38d62
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?26c0e173b3944ce2874accbc3ca38d62
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://help.bellsouth.net/sdccommon/download/tgctlcm.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://aol.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://activation.alltel.com/wizlet/WINDSTREAM/static/controls/WebflowActiveXInstaller_2-0-0.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: lxbx_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbxcoms.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe






    START UP LIST

    StartupList report, 8/31/2007, 11:18:27 PM
    StartupList version: 1.52.2
    Started from : C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.EXE
    Detected: Windows XP SP2 (WinNT 5.01.2600)
    Detected: Internet Explorer v7.00 (7.00.6000.16512)
    * Using default options
    ==================================================

    Running processes:

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
    C:\Program Files\Lexmark 7100 Series\ezprint.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\Common Files\AOL\1179861557\ee\AOLSoftware.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\lxbxcoms.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Live Toolbar\msn_sl.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe

    --------------------------------------------------

    Checking Windows NT UserInit:

    [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINDOWS\system32\userinit.exe,

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    ehTray = C:\WINDOWS\ehome\ehtray.exe
    Recguard = C:\WINDOWS\SMINST\RECGUARD.EXE
    ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    CHotkey = zHotkey.exe
    ShowWnd = ShowWnd.exe
    NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    nwiz = nwiz.exe /install
    NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    RemoteControl = "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
    SoundMan = SOUNDMAN.EXE
    SunKistEM = C:\Program Files\Digital Media Reader\shwiconem.exe
    (Default) =

    --------------------------------------------------

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run

    MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

    --------------------------------------------------

    Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

    Shell=*INI section not found*
    SCRNSAVE.EXE=*INI section not found*
    drivers=*INI section not found*

    Shell & screensaver key from Registry:

    Shell=Explorer.exe
    SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
    drivers=*Registry value not found*

    Policies Shell key:

    HKCU\..\Policies: Shell=*Registry key not found*
    HKLM\..\Policies: Shell=*Registry value not found*

    --------------------------------------------------


    Enumerating Browser Helper Objects:

    (no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    (no name) - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
    (no name) - (no file) - {549B5CA7-4A86-11D7-A4DF-000874180BB3}
    (no name) - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
    (no name) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
    Web assistant - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll - {9ECB9560-04F9-4bbc-943D-298DDF1699E1}
    (no name) - C:\Program Files\Windows Live Toolbar\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
    (no name) - (no file) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

    --------------------------------------------------

    Enumerating Task Scheduler jobs:

    Check Updates for Windows Live Toolbar.job
    McAfee.com Update Check (YOUR-0B93D0C340-Owner).job
    WebReg 20070521234710.job

    --------------------------------------------------

    Enumerating Download Program Files:

    [Support.com Configuration Class]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\tgctlcm.dll
    CODEBASE = http://help.bellsouth.net/sdccommon/download/tgctlcm.cab

    [Musicnotes Viewer]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\mnviewer.dll
    CODEBASE = http://aol.musicnotes.com/download/mnviewer.cab

    [Shockwave ActiveX Control]
    InProcServer32 = C:\WINDOWS\system32\macromed\Director\SwDir.dll
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

    [{321FB770-1FBE-4BFE-BDC1-6F622D4FA499}]
    CODEBASE = https://activation.alltel.com/wizlet/WINDSTREAM/static/controls/WebflowActiveXInstaller_2-0-0.cab

    [Shockwave Flash Object]
    InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx
    CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab

    --------------------------------------------------

    Enumerating ShellServiceObjectDelayLoad items:

    PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
    CDBurn: C:\WINDOWS\system32\SHELL32.dll
    WebCheck: C:\WINDOWS\system32\webcheck.dll
    SysTray: C:\WINDOWS\system32\stobject.dll
    UPnPMonitor: C:\WINDOWS\system32\upnpui.dll

    --------------------------------------------------
    End of report, 7,331 bytes
    Report generated in 0.031 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /full - to include several rarely-important sections
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only


  2. #2
    chopper is offline Newbie
    Hi ashstars

    Perform an online scan with Trend Micro™ Anti-Spyware (by clicking the "Scan and Clean your PC" button).
    • Follow the prompts to install the ActiveX controls
    • It will say "Loading TrendMicro definitions".
    • Click "Start Scan"
    After it's done scanning, click "Scan Results"
    • Make sure all items found have a check next to them, then click "Clean Threats Now".
    • Click Exit.
    Reboot your computer. I then need you to repeat the same procedure above again using the TrendMicro tool.

    Then please post back with results of scan

  3. #3
    ashstars is offline Newbie
    ~I ran trend micro, rebooted and ran it again as instructed. Here is the latest HJT log.



    Logfile of HijackThis v1.99.1
    Scan saved at 6:23:54 PM, on 9/5/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
    C:\Program Files\Lexmark 7100 Series\ezprint.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\Common Files\AOL\1179861557\ee\AOLSoftware.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\lxbxcoms.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
    C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 5 for hijackthis.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtim e.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
    O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
    O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7100 Series\ezprint.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1179861557\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?26c0e173b3944ce2874accbc3ca38d62
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?26c0e173b3944ce2874accbc3ca38d62
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://help.bellsouth.net/sdccommon/download/tgctlcm.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://aol.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://activation.alltel.com/wizlet/WINDSTREAM/static/controls/WebflowActiveXInstaller_2-0-0.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: lxbx_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbxcoms.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

  4. #4
    chopper is offline Newbie
    Hi ashstars

    sorry for the delay can you have Hijackthis delete this entry
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

    Then please run this online scan with these instructions

    Perform an online scan with Internet Explorer with Panda ActiveScan

    Click on the "Free To Use ActiveScan" located on the top right hand corner
    1. Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
    2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *
    Begin the scan by selecting My Computer
    • If it finds any malware, it will offer you a report.
    • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
    • Click on See report then click Save report
    * You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
    * Turn off the real time scanner of any existing antivirus program while performing the online scan


    Paste the Panda Scan report here together with a new HiJack This log.

  5. #5
    ashstars is offline Newbie
    ~PANDA ACTIV SCAN~




    Incident Status Location

    Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt
    Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt
    Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt
    Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Owner\Cookies\owner@adrevolver[2].txt
    Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Owner\Cookies\owner@ads.addynamix[1].txt
    Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Owner\Cookies\owner@ads.pointroll[1].txt
    Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Owner\Cookies\owner@ads.pointroll[3].txt
    Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Owner\Cookies\owner@adserver.easyad[2].txt
    Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Owner\Cookies\owner@adtech[2].txt
    Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Owner\Cookies\owner@adtech[3].txt
    Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Owner\Cookies\owner@advertising[1].txt
    Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Owner\Cookies\owner@advertising[2].txt
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner\Cookies\owner@atdmt[3].txt
    Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner\Cookies\owner@atwola[1].txt
    Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner\Cookies\owner@atwola[2].txt
    Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Owner\Cookies\owner@azjmp[1].txt
    Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Owner\Cookies\owner@bluestreak[2].txt
    Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Owner\Cookies\owner@bravenet[1].txt
    Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Cookies\owner@bs.serving-sys[1].txt
    Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Cookies\owner@bs.serving-sys[3].txt
    Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Owner\Cookies\owner@casalemedia[1].txt
    Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Owner\Cookies\owner@citi.bridgetrack[1].txt
    Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Cookies\owner@com[1].txt
    Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Cookies\owner@com[2].txt
    Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\Owner\Cookies\owner@counter.hitslink[1].txt
    Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Owner\Cookies\owner@did-it[2].txt
    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt
    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Cookies\owner@doubleclick[2].txt
    Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Owner\Cookies\owner@ehg-dig.hitbox[1].txt
    Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Owner\Cookies\owner@enhance[1].txt
    Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Owner\Cookies\owner@enhance[2].txt
    Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Cookies\owner@fastclick[2].txt
    Spyware:Cookie/GoClick Not disinfected C:\Documents and Settings\Owner\Cookies\owner@goclick[2].txt
    Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Owner\Cookies\owner@go[2].txt
    Spyware:Cookie/Adrevolver

  6. #6
    ashstars is offline Newbie
    Not disinfected C:\Documents and Settings\Owner\Cookies\owner@media.adrevolver[3].txt
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Cookies\owner@mediaplex[2].txt
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Cookies\owner@mediaplex[3].txt
    Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Owner\Cookies\owner@overture[1].txt
    Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Owner\Cookies\owner@overture[2].txt
    Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Owner\Cookies\owner@perf.overture[1].txt
    Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt
    Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt
    Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Cookies\owner@realmedia[1].txt
    Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt
    Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Cookies\owner@realmedia[3].txt
    Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Owner\Cookies\owner@revenue[1].txt
    Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Owner\Cookies\owner@searchportal.informat ion[1].txt
    Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Owner\Cookies\owner@searchportal.informat ion[2].txt
    Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Owner\Cookies\owner@server.iad.liveperson[7].txt
    Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt
    Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Cookies\owner@serving-sys[3].txt
    Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Owner\Cookies\owner@stat.onestat[2].txt
    Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Owner\Cookies\owner@statse.webtrendslive[1].txt
    Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Owner\Cookies\owner@target[1].txt
    Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Owner\Cookies\owner@target[2].txt
    Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Owner\Cookies\owner@trafficmp[2].txt
    Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Owner\Cookies\owner@trafficmp[3].txt
    Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[1].txt
    Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Owner\Cookies\owner@www.burstbeacon[1].txt
    Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Owner\Cookies\owner@xiti[1].txt
    Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Owner\Cookies\owner@yadro[1].txt
    Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Owner\Cookies\owner@zedo[2].txt
    Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\LocalService\Cookies\owner@advertising[1].txt
    Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[servedby.advertising.com/]
    Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.advertising.com/]
    Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[servedby.advertising.com/]
    Spyware:Cookie/QkSrv Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.qksrv.net/]
    Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.advertising.com/]
    Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[server.iad.liveperson.net/hc/42435556]
    Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[server.iad.liveperson.net/]
    Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[server.iad.liveperson.net/hc/42435556]
    Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[server.iad.liveperson.net/]
    Spyware:Cookie/Doubleclick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.doubleclick.net/]
    Spyware:Cookie/2o7 Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.2o7.net/]
    Spyware:Cookie/Atlas DMT Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.atdmt.com/]
    Spyware:Cookie/Mediaplex Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.mediaplex.com/]
    Spyware:Cookie/PointRoll Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.ads.pointroll.com/]
    Spyware:Cookie/QuestionMarket Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.questionmarket.com/]
    Spyware:Cookie/Statcounter Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.statcounter.com/]
    Spyware:Cookie/Casalemedia Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.casalemedia.com/]
    Spyware:Cookie/HotLog Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.hotlog.ru/]
    Spyware:Cookie/SpyLog

  7. #7
    ashstars is offline Newbie
    Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.spylog.com/]
    Spyware:Cookie/2o7 Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.112.2o7.net/]
    Spyware:Cookie/Zedo Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.zedo.com/]
    Spyware:Cookie/Go Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.go.com/]
    Spyware:Cookie/Bluestreak Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.bluestreak.com/]
    Spyware:Cookie/Serving-sys Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.serving-sys.com/]
    Spyware:Cookie/Serving-sys Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.bs.serving-sys.com/]
    Spyware:Cookie/Bridgetrack Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[citi.bridgetrack.com/]
    Spyware:Cookie/Tribalfusion Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.tribalfusion.com/]
    Spyware:Cookie/FastClick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.fastclick.net/]
    Spyware:Cookie/Atwola Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.atwola.com/]
    Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.com.com/]
    Spyware:Cookie/MediaTickets Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.kinghost.com/]
    Spyware:Cookie/SexList Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.sexlist.com/]
    Spyware:Cookie/YieldManager Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[ad.yieldmanager.com/]
    Spyware:Cookie/RealMedia Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.realmedia.com/]
    Spyware:Cookie/Hitbox Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.ehg-dig.hitbox.com/]
    Spyware:Cookie/cs.sexcounter Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.cs.sexcounter.com/]
    Spyware:Cookie/adultfriendfinder Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.adultfriendfinder.com/]
    Spyware:Cookie/WebtrendsLive Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[statse.webtrendslive.com/]
    Spyware:Cookie/Traffic Marketplace Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.trafficmp.com/]
    Spyware:Cookie/Bfast Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.bfast.com/]
    Spyware:Cookie/Maxserving Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.maxserving.com/]
    Spyware:Cookie/Adrevolver Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.adrevolver.com/]
    Spyware:Cookie/Toplist Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.toplist.cz/]
    Spyware:Cookie/Falkag Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.as-us.falkag.net/]
    Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[ad.sensismediasmart.com.au/]
    Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.gamearena.com.au/]
    Spyware:Cookie/myaffiliateprogram Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.www.myaffiliateprogram.com/]
    Spyware:Cookie/TeensForCash Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.teensforcash.com/]
    Spyware:Cookie/PayCounter Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.paycounter.com/]
    Spyware:Cookie/Azjmp Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[.azjmp.com/]
    Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\wd3ew28i.default\coo kies.txt[server.iad.liveperson.net/hc/87882621]
    Spyware:Cookie/Doubleclick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\he1eg7tg.slt\cookies .txt[.doubleclick.net/]
    Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\he1eg7tg.slt\cookies .txt[.advertising.com/]
    Spyware:Cookie/Doubleclick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\he1eg7tg.slt\cookies .txt[.doubleclick.net/]
    Spyware:Cookie/Atwola Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\he1eg7tg.slt\cookies .txt[.atwola.com/]
    Spyware:Cookie/2o7 Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\he1eg7tg.slt\cookies .txt[.2o7.net/]
    Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Cookies\owner@advertising[2].txt
    Spyware:Cookie/Atlas DMT Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt
    Spyware:Cookie/Doubleclick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt
    Spyware:Cookie/FastClick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Cookies\owner@fastclick[2].txt
    Spyware:Cookie/QuestionMarket Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt
    Spyware:Cookie/RealMedia Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@247realmedia[1].txt
    Spyware:Cookie/2o7 Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@2o7[2].txt
    Spyware:Cookie/YieldManager Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@ad.yieldmanager[2].txt
    Spyware:Cookie/AdDynamix Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@ads.addynamix[2].txt
    Spyware:Cookie/PointRoll Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@ads.pointroll[1].txt
    Spyware:Cookie/adultfriendfinder Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@adultfriendfinder[2].txt
    Spyware:Cookie/Advertising

  8. #8
    ashstars is offline Newbie
    Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@advertising[2].txt
    Spyware:Cookie/Apmebf Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@apmebf[2].txt
    Spyware:Cookie/Falkag Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@as-us.falkag[1].txt
    Spyware:Cookie/Atlas DMT Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@atdmt[2].txt
    Spyware:Cookie/Atwola Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@atwola[2].txt
    Spyware:Cookie/Azjmp Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@azjmp[1].txt
    Spyware:Cookie/Belnk Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@belnk[1].txt
    Spyware:Cookie/Bfast Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@bfast[2].txt
    Spyware:Cookie/Bluestreak Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@bluestreak[1].txt
    Spyware:Cookie/Serving-sys Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@bs.serving-sys[1].txt
    Spyware:Cookie/BurstNet Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@burstnet[2].txt
    Spyware:Cookie/Casalemedia Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@casalemedia[1].txt
    Spyware:Cookie/Ccbill Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@ccbill[2].txt
    Spyware:Cookie/Cgi-bin Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@cgi-bin[3].txt
    Spyware:Cookie/Cgi-bin Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@cgi-bin[4].txt
    Spyware:Cookie/Cgi-bin Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@cgi-bin[5].txt
    Spyware:Cookie/Bridgetrack Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@citi.bridgetrack[1].txt
    Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@com[2].txt
    Spyware:Cookie/Sextracker Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@counter1.sextracker[2].txt
    Spyware:Cookie/Sextracker Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@counter13.sextracker[2].txt
    Spyware:Cookie/Sextracker Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@counter16.sextracker[1].txt
    Spyware:Cookie/Sextracker Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@counter6.sextracker[1].txt
    Spyware:Cookie/cs.sexcounter Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@cs.sexcounter[2].txt
    Spyware:Cookie/360i Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@ct.360i[1].txt
    Spyware:Cookie/Belnk Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@dist.belnk[2].txt
    Spyware:Cookie/Doubleclick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@doubleclick[1].txt
    Spyware:Cookie/Hitbox Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@ehg-dig.hitbox[2].txt
    Spyware:Cookie/Hitbox Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@ehg-macpublishingllc.hitbox[2].txt
    Spyware:Cookie/FastClick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@fastclick[2].txt
    Spyware:Cookie/Go Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@go[2].txt
    Spyware:Cookie/Humanclick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@hc2.humanclick[2].txt
    Spyware:Cookie/Hitbox Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@hg1.hitbox[1].txt
    Spyware:Cookie/HotLog Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@hotlog[1].txt
    Spyware:Cookie/MediaTickets Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@kinghost[2].txt
    Spyware:Cookie/DomainSponsor Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@landing.domainsponsor[1].txt
    Spyware:Cookie/Maxserving Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@maxserving[1].txt
    Spyware:Cookie/Mediaplex Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@mediaplex[2].txt
    Spyware:Cookie/Overture Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@overture[1].txt
    Spyware:Cookie/PayCounter Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@paycounter[2].txt
    Spyware:Cookie/Overture Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@perf.overture[1].txt
    Spyware:Cookie/QkSrv Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@qksrv[2].txt
    Spyware:Cookie/Qsrch Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@qsrch[1].txt
    Spyware:Cookie/QuestionMarket Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@questionmarket[2].txt
    Spyware:Cookie/RealMedia Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@realmedia[1].txt
    Spyware:Cookie/WUpd Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@revenue[1].txt
    Spyware:Cookie/Advertising

  9. #9
    ashstars is offline Newbie
    Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@servedby.advertising[2].txt
    Spyware:Cookie/Serving-sys Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@serving-sys[2].txt
    Spyware:Cookie/SexList Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@sexlist[1].txt
    Spyware:Cookie/Sextracker Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@sextracker[1].txt
    Spyware:Cookie/Statcounter Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@statcounter[1].txt
    Spyware:Cookie/Tradedoubler Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@tradedoubler[1].txt
    Spyware:Cookie/Traffic Marketplace Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@trafficmp[2].txt
    Spyware:Cookie/Tribalfusion Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@tribalfusion[1].txt
    Spyware:Cookie/Valueclick Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@valueclick[1].txt
    Spyware:Cookie/BurstBeacon Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@www.burstbeacon[1].txt
    Spyware:Cookie/XXXCounter Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@xxxcounter[1].txt
    Spyware:Cookie/Yadro Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@yadro[1].txt
    Spyware:Cookie/Adserver Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@z1.adserver[1].txt
    Spyware:Cookie/Zedo Not disinfected C:\My Backup -- 03-10-06 0834\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@zedo[1].txt
    Adware:Adware/Trymedia Not disinfected C:\My Backup -- 03-10-06 0834\Downloads\BeachHeadDesertWar-dm[1].exe
    Potentially unwanted tool:Application/PSkill.M Not disinfected C:\My Backup -- 03-10-06 0834\Program Files\TitanShield Antispyware\pkill.exe
    Adware:Adware/WUpd Not disinfected C:\My Backup -- 03-10-06 0834\WINDOWS\Downloaded Program Files\MediaGatewayX.dll
    Virus:Generic Malware Disinfected C:\WINDOWS\system32\drivers\kgdyygyz.sys

  10. #10
    ashstars is offline Newbie
    Save 20% on AVG Internet Security 2012 Suite!
    Logfile of HijackThis v1.99.1
    Scan saved at 8:55:04 PM, on 9/14/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
    C:\Program Files\Lexmark 7100 Series\ezprint.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\Common Files\AOL\1179861557\ee\AOLSoftware.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\lxbxcoms.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
    C:\PROGRA~1\Rhapsody\rhaphlpr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
    C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Windows Live Toolbar\msn_sl.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 7 for hijackthis.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtim e.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
    O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
    O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7100 Series\ezprint.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1179861557\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?26c0e173b3944ce2874accbc3ca38d62
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?26c0e173b3944ce2874accbc3ca38d62
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://help.bellsouth.net/sdccommon/download/tgctlcm.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://aol.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://activation.alltel.com/wizlet/WINDSTREAM/static/controls/WebflowActiveXInstaller_2-0-0.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: lxbx_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbxcoms.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

+ Reply to Thread