TheTechGuide Forum

General Category => Tech Clinic => Topic started by: shantalita on December 05, 2006, 08:30:49 PM

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: shantalita on December 05, 2006, 08:30:49 PM

Hi, I read the previous post on how to deal with the worm...I downloaded Hijack this, but now I don't know whether or not to do the same things the last guy did. here is my log:

Logfile of HijackThis v1.99.1
Scan saved at 5:21:51 PM, on 12/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Webshots\Webshots.scr
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\Documents and Settings\shantal\Desktop\hijack\HijackThis.exe

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\3.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\3.bin\MWSSRCAS.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\3.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZSYYYYYYDFUS (http://\"http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZSYYYYYYDFUS\")
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 (http://\"http://go.microsoft.com/fwlink/?linkid=39204\")
O16 - DPF: {18C3FD15-74F6-4280-9C98-3590C966B7B8} (SkillGam Control) - http://www.worldwinner.com/games/v46/skillgam/skillgam.cab (http://\"http://www.worldwinner.com/games/v46/skillgam/skillgam.cab\")
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab (http://\"http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab\")
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe (http://\"http://moneycentral.msn.com/cabs/pmupd806.exe\")
O16 - DPF: {5EE92643-21CE-4949-903F-39439DCC3944} (Shapetris Control) - http://www.worldwinner.com/games/v42/shape/shape.cab (http://\"http://www.worldwinner.com/games/v42/shape/shape.cab\")
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab (http://\"http://www.worldwinner.com/games/shared/wwlaunch.cab\")
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab (http://\"http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab\")
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab (http://\"http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab\")
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = osservice.com
O17 - HKLM\Software\..\Telephony: DomainName = osservice.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = osservice.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

thanks

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: guestolo on December 05, 2006, 08:50:05 PM

Can you do the following please, I just want to check on something
supply an uninstall list from Hijackthis
Open Hijackthis>>Open MISC TOOLS SECTION>>Open UNINSTALL MANAGER
Click the SAVE LIST... button
Save the list to your desktop then copy>>Paste back here the Whole contents

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: shantalita on December 05, 2006, 09:32:52 PM

Ad-Aware SE Personal
Adobe Flash Player 9 ActiveX
Adobe Photoshop 7.0
Adobe Reader 7.0.7
AOL Instant Messenger
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
ATI RADEON 8500 Bubbles Screen Saver v1.1
ATI RADEON 8500 Ocean Screen Saver v1.1
Audacity 1.2.4
BCM V.92 56K Modem
Broadcom 440x Driver Installer
C-Major Audio
Conexant D480 MDC V.9x Modem
Dell Photo Printer 720
Dell Wireless WLAN Card
EphPod
Google Gmail Notifier
Google Talk (remove only)
Google Toolbar for Internet Explorer
HijackThis 1.99.1
HP Customer Participation Program 7.0
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HP Software Update
HP Solution Center 7.0
iTunes
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
LimeWire 4.9.30
Macromedia Shockwave Player
MDL ISIS Draw 2.5 Standalone
Microsoft .NET Framework 1.1
Microsoft AntiSpyware
Microsoft Office Professional Edition 2003
MSN Messenger 7.5
MSN Money Investment Toolbox
MSXML 4.0 SP2 (KB927978)
My Web Search (Smiley Central)
OCR Software by I.R.I.S 7.0
PowerDVD
RealPlayer
Rio Music Manager
Rio Taxi
Roxio Easy Media Creator 7
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925486)
SpeedFan (remove only)
Synaptics Pointing Device Driver
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
USB Driver
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Webshots Desktop
Wild Jack Casino
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
Yahoo! Toolbar

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: guestolo on December 05, 2006, 10:11:04 PM

Can you do the following please

We should update your version of Java
Malware can exploit the holes in older versions

Can you do the following
==Download the latest version of  Java Runtime Environment (JRE) 5.0 Update 10 (http://\"http://java.sun.com/javase/downloads/index.jsp\")

• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  
• Click the "Download" button to the right.
  
• Check the box that says: "Accept License Agreement[/i]".
  
• The page will refresh.
• Click on the link to download Windows Offline Installation Multi-language
  

Save the file to your Desktop.
Don't install it yet

Open your Windows control panel>>Start>>control Panel
Ensure you are in Classic view
Double click to open the Java Icon>>Under the General tab click "Delete Files"
Leave all 3 selections checked and click "OK"
Exit Java

Access your Add/remove programs via Control Panel
Remove the following
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
My Web Search (Smiley Central)
Viewpoint Manager (Remove Only)
Viewpoint Media Player


Download and save [color=\"red\"]Brute Force Uninstaller[/color] (http://\"http://www.merijn.org/files/bfu.zip\")[/b] to the desktop

• Right click the BFU folder on your desktop, and choose Extract All
  
• Click "Next"
• In the box to choose where to extract the files to, click "Browse"
• Click on the + sign next to "My Computer"
• Click on "Local Disk (C:) or whatever your primary drive is
• Click "Make New Folder"
• Type in BFU
  
• Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
  

[color=\"red\"]RIGHT-CLICK HERE[/color] (http://\"http://metallica.geekstogo.com/alcanshorty.bfu\")[/b] and choose "Save As" (in IE it's "Save Target As") in order to download [color=\"red\"]Alcan worm remover[/color].
Save it then transfer to the
same folder you made earlier (c:\BFU).

Go to Start > My Computer and navigate to the C:\BFU folder.

• Start the Brute Force Uninstaller by doubleclicking BFU.exe
  
• Next to the scriptline to execute field click the folder icon [imghttp://metallica.geekstogo.com/foldericon.png[/img]
  and select alcanshorty.bfu
  
• Press Execute and let it do it's job. (You ought to see a progress bar if you did this correctly.)
  
• Wait for the complete script execution box to pop up and press OK.
  
• Press exit to terminate the BFU program.
  

Reboot your computer

Back in Windows
Go ahead and Install the latest version of Java from the installer on desktop
You can delete the installer after you have it installed

Download this file - Combofix.exe (http://\"http://download.bleepingcomputer.com/sUBs/combofix.exe\") and save it too desktop
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

I need to see all the following
1. Post the log from Combofix
2. Post a fresh hijackthis log

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: shantalita on December 06, 2006, 12:32:58 PM

Here's the post from combofix.exe:

C:\onoes.exe
C:\WINDOWS\system32\bszip.dll

 
(((((((((((((((((((((((((((((((   Files Created from 2006-11-06 to 2006-12-06  ))))))))))))))))))))))))))))))))))
 
 
2006-12-06 09:25 <DIR> d-------- C:\Program Files\Common Files\Java
2006-12-06 09:21 <DIR> d-------- C:\bintheredunthat
2006-12-06 09:15 <DIR> d-------- C:\BFU
2006-12-06 09:11 360,448 --a------ C:\Program Files\Uninstall My Web Search.dll
2006-12-04 19:16 <DIR> d--hs---- C:\Documents and Settings\shantal\Complete
2006-11-29 11:16 <DIR> d-------- C:\Documents and Settings\shantal\Application Data\HP
2006-11-29 11:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HP
2006-11-29 11:13 <DIR> d-------- C:\bin
2006-11-29 11:11 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared
2006-11-29 11:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sonic
2006-11-29 11:05 <DIR> dr--s---- C:\WINDOWS\assembly
2006-11-29 11:05 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2006-11-29 11:05 <DIR> d-------- C:\WINDOWS\Microsoft.NET
2006-11-29 11:04 <DIR> d-------- C:\Program Files\Common Files\HP
2006-11-29 11:00 <DIR> d-------- C:\Program Files\Hewlett-Packard
2006-11-29 10:59 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-11-29 10:58 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2006-11-29 10:58 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2006-11-29 10:57 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll
2006-11-29 10:57 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2006-11-29 10:56 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2006-11-29 10:51 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-11-29 10:51 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-11-29 10:51 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-11-29 10:51 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-11-29 10:51 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-11-29 10:51 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2006-11-29 10:49 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2006-11-29 10:49 <DIR> d--h----- C:\Config.Msi
2006-11-29 10:49 <DIR> d-------- C:\Program Files\HP
2006-11-27 00:46 <DIR> d-------- C:\Program Files\MSN Games
2006-11-20 13:02 <DIR> d-------- C:\Program Files\MSXML 4.0
2006-11-20 13:02 <DIR> d-------- C:\61eeefb2ecf368bbfeb7
2006-11-14 18:48 <DIR> d-------- C:\Program Files\Microsoft Money 2006


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-06 09:27 -------- d-------- C:\Program Files\Microsoft AntiSpyware
2006-12-06 09:26 -------- d-------- C:\Program Files\Java
2006-12-06 09:25 -------- d-------- C:\Program Files\Common Files
2006-12-06 09:23 -------- d-------- C:\Program Files\MyWebSearch
2006-12-06 09:11 -------- d-------- C:\Program Files\MSN Messenger
2006-12-06 09:11 -------- d-------- C:\Program Files\Internet Explorer
2006-12-05 19:29 -------- d-------- C:\Program Files\SpeedFan
2006-11-29 17:33 -------- d---s---- C:\Documents and Settings\shantal\Application Data\Microsoft
2006-11-28 11:10 -------- d-------- C:\Documents and Settings\shantal\Application Data\Adobe
2006-11-22 22:28 -------- d-------- C:\Program Files\FunWebProducts
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-10-23 09:55 -------- d-------- C:\Program Files\Dell 720
2006-10-17 20:38 -------- d-------- C:\Documents and Settings\shantal\Application Data\Google
2006-10-17 18:35 -------- d-------- C:\Program Files\Google
2006-10-13 04:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 04:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 04:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-13 02:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys
2006-10-09 15:58 -------- d-------- C:\Program Files\AIM
2006-10-09 15:57 -------- d-------- C:\Program Files\AOD
2006-09-12 21:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
 
 
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"googletalk"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"Dell Wireless Manager UI"="C:\\WINDOWS\\system32\\WLTRAY"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb07.exe"
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"BCMSMMSG"="BCMSMMSG.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
  00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00,\
  00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-12-06  9:29:31.05
C:\ComboFix.txt ... 06-12-06 09:29


and the log from hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 9:31:47 AM, on 12/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Webshots\Webshots.scr
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\shantal\Desktop\hijack\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 (http://\"http://go.microsoft.com/fwlink/?linkid=39204\")
O16 - DPF: {18C3FD15-74F6-4280-9C98-3590C966B7B8} (SkillGam Control) - http://www.worldwinner.com/games/v46/skillgam/skillgam.cab (http://\"http://www.worldwinner.com/games/v46/skillgam/skillgam.cab\")
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab (http://\"http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab\")
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe (http://\"http://moneycentral.msn.com/cabs/pmupd806.exe\")
O16 - DPF: {5EE92643-21CE-4949-903F-39439DCC3944} (Shapetris Control) - http://www.worldwinner.com/games/v42/shape/shape.cab (http://\"http://www.worldwinner.com/games/v42/shape/shape.cab\")
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab (http://\"http://www.worldwinner.com/games/shared/wwlaunch.cab\")
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab (http://\"http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab\")
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab (http://\"http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab\")
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = osservice.com
O17 - HKLM\Software\..\Telephony: DomainName = osservice.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = osservice.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: guestolo on December 06, 2006, 10:53:46 PM

Your hijackthis log looks good
But can you repost the log from Combofix please, you cut off the top part of it
by default the log is located at this location
C:\Combofix.txt

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: shantalita on December 07, 2006, 08:53:55 PM

shantal - 06-12-06  9:28:06.52    Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\shantal\Desktop\hijack"

((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
 

C:\onoes.exe
C:\WINDOWS\system32\bszip.dll

 
(((((((((((((((((((((((((((((((   Files Created from 2006-11-06 to 2006-12-06  ))))))))))))))))))))))))))))))))))
 
 
2006-12-06 09:25 <DIR> d-------- C:\Program Files\Common Files\Java
2006-12-06 09:21 <DIR> d-------- C:\bintheredunthat
2006-12-06 09:15 <DIR> d-------- C:\BFU
2006-12-06 09:11 360,448 --a------ C:\Program Files\Uninstall My Web Search.dll
2006-12-04 19:16 <DIR> d--hs---- C:\Documents and Settings\shantal\Complete
2006-11-29 11:16 <DIR> d-------- C:\Documents and Settings\shantal\Application Data\HP
2006-11-29 11:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HP
2006-11-29 11:13 <DIR> d-------- C:\bin
2006-11-29 11:11 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared
2006-11-29 11:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sonic
2006-11-29 11:05 <DIR> dr--s---- C:\WINDOWS\assembly
2006-11-29 11:05 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2006-11-29 11:05 <DIR> d-------- C:\WINDOWS\Microsoft.NET
2006-11-29 11:04 <DIR> d-------- C:\Program Files\Common Files\HP
2006-11-29 11:00 <DIR> d-------- C:\Program Files\Hewlett-Packard
2006-11-29 10:59 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-11-29 10:58 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2006-11-29 10:58 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2006-11-29 10:57 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll
2006-11-29 10:57 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2006-11-29 10:56 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2006-11-29 10:51 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-11-29 10:51 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-11-29 10:51 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-11-29 10:51 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-11-29 10:51 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-11-29 10:51 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2006-11-29 10:49 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2006-11-29 10:49 <DIR> d--h----- C:\Config.Msi
2006-11-29 10:49 <DIR> d-------- C:\Program Files\HP
2006-11-27 00:46 <DIR> d-------- C:\Program Files\MSN Games
2006-11-20 13:02 <DIR> d-------- C:\Program Files\MSXML 4.0
2006-11-20 13:02 <DIR> d-------- C:\61eeefb2ecf368bbfeb7
2006-11-14 18:48 <DIR> d-------- C:\Program Files\Microsoft Money 2006


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-06 09:27 -------- d-------- C:\Program Files\Microsoft AntiSpyware
2006-12-06 09:26 -------- d-------- C:\Program Files\Java
2006-12-06 09:25 -------- d-------- C:\Program Files\Common Files
2006-12-06 09:23 -------- d-------- C:\Program Files\MyWebSearch
2006-12-06 09:11 -------- d-------- C:\Program Files\MSN Messenger
2006-12-06 09:11 -------- d-------- C:\Program Files\Internet Explorer
2006-12-05 19:29 -------- d-------- C:\Program Files\SpeedFan
2006-11-29 17:33 -------- d---s---- C:\Documents and Settings\shantal\Application Data\Microsoft
2006-11-28 11:10 -------- d-------- C:\Documents and Settings\shantal\Application Data\Adobe
2006-11-22 22:28 -------- d-------- C:\Program Files\FunWebProducts
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-10-23 09:55 -------- d-------- C:\Program Files\Dell 720
2006-10-17 20:38 -------- d-------- C:\Documents and Settings\shantal\Application Data\Google
2006-10-17 18:35 -------- d-------- C:\Program Files\Google
2006-10-13 04:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 04:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 04:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-13 02:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys
2006-10-09 15:58 -------- d-------- C:\Program Files\AIM
2006-10-09 15:57 -------- d-------- C:\Program Files\AOD
2006-09-12 21:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
 
 
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"googletalk"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"Dell Wireless Manager UI"="C:\\WINDOWS\\system32\\WLTRAY"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb07.exe"
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"BCMSMMSG"="BCMSMMSG.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
  00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00,\
  00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-12-06  9:29:31.05
C:\ComboFix.txt ... 06-12-06 09:29

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: guestolo on December 07, 2006, 09:21:21 PM

Looks good
Find and delete the following
C:\Program Files\Uninstall My Web Search.dll <-this file

C:\Program Files\MyWebSearch <-folder
C:\Program Files\FunWebProducts <-folder
C:\bintheredunthat <-folder
C:\BFU <-folder

Delete Combofix.exe from desktop

Do a "System scan only" with Hijackthis and put a check next to these entries:

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab (http://\"http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab\")


After you have ticked the above entries, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Open Ad-Aware SE Personal, ensure to click the  check for updates now link and Connect to download the latest updates

Click START
Click the radio button to Perform a Full system scan then click NEXT
When it's finished scanning
At this point you should either right click on the screen and and choose the "Select All" Objects option or individually put a checkmark in each objects checkbox
click on the Next button. Ad-Aware SE will now present you with a confirmation box as to whether or not you would like to remove the objects you have just selected. Press the "OK" button

RESTART your computer to finish the cleaning process


Come back here and post a fresh hijackthis log

I don't see any AntiVirus software on this computer
It's not safe being online without proper protection
Do you have your own to install? Or do you need a free solution?
I have links to free ones that do a great job, let me know please

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: shantalita on December 08, 2006, 12:19:59 AM

here is the new hijack log. I ran the ad-aware scan again, and the files didn't come up. so looks like it worked! as far as an anti-virus, I used to have norton, but it slowed down my computer so much that I removed it. It was become too much of a hassle with all of the blocks it put up. If you have any suggestions with better anti virus, please let me know! thanks a lot for your help!

Logfile of HijackThis v1.99.1
Scan saved at 8:29:46 PM, on 12/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Webshots\Webshots.scr
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\shantal\Desktop\hijack\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 (http://\"http://go.microsoft.com/fwlink/?linkid=39204\")
O16 - DPF: {18C3FD15-74F6-4280-9C98-3590C966B7B8} (SkillGam Control) - http://www.worldwinner.com/games/v46/skillgam/skillgam.cab (http://\"http://www.worldwinner.com/games/v46/skillgam/skillgam.cab\")
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe (http://\"http://moneycentral.msn.com/cabs/pmupd806.exe\")
O16 - DPF: {5EE92643-21CE-4949-903F-39439DCC3944} (Shapetris Control) - http://www.worldwinner.com/games/v42/shape/shape.cab (http://\"http://www.worldwinner.com/games/v42/shape/shape.cab\")
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab (http://\"http://www.worldwinner.com/games/shared/wwlaunch.cab\")
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab (http://\"http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab\")
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab (http://\"http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab\")
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = osservice.com
O17 - HKLM\Software\..\Telephony: DomainName = osservice.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = osservice.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: guestolo on December 10, 2006, 10:22:59 AM

Sorry for the delay
Try one of these free AV's
ONLY USE ONE. More than one can cause conflicts and slow your system noticeably

AVG 7 by Grisoft (http://\"http://free.grisoft.com/doc/2/lng/us/tpl/v5\")
OR
Avast Home Edition by ALWIL (http://\"http://www.avast.com/eng/down_home.html\")
OR
Avira AntiVir Personal Edition Classic (http://\"http://www.free-av.com/antivirus/allinonen.html\")

There's another one by AOL which requires no subscription
Active Virus Shield (http://\"http://www.activevirusshield.com/antivirus/freeav/index.adp\")?
I haven't been recommending it yet, because I haven't installed and used it myself
It uses the Kapersky's scanning engine, so it should be good
I'll be trying it later this week.

They all have a free version
Decide which ONE is right for you
After installation, ensure it is updated, run a full system scan

come back here, post one last hijackthis log and let me know how things are running again

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: shantalita on December 11, 2006, 05:02:31 PM

Avast Home Edition by ALWIL (http://\"http://www.avast.com/eng/down_home.html\")
 
I downloaded the above scan and it found a win32:sdbot-gen44 virus. I wasn't sure whether or not to delete the files so I ignored them for now. I ran another hijackthis. here is the log:
Logfile of HijackThis v1.99.1
Scan saved at 1:59:00 PM, on 12/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Webshots\Webshots.scr
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\shantal\Desktop\hijack\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 (http://\"http://go.microsoft.com/fwlink/?linkid=39204\")
O16 - DPF: {18C3FD15-74F6-4280-9C98-3590C966B7B8} (SkillGam Control) - http://www.worldwinner.com/games/v46/skillgam/skillgam.cab (http://\"http://www.worldwinner.com/games/v46/skillgam/skillgam.cab\")
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe (http://\"http://moneycentral.msn.com/cabs/pmupd806.exe\")
O16 - DPF: {5EE92643-21CE-4949-903F-39439DCC3944} (Shapetris Control) - http://www.worldwinner.com/games/v42/shape/shape.cab (http://\"http://www.worldwinner.com/games/v42/shape/shape.cab\")
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab (http://\"http://www.worldwinner.com/games/shared/wwlaunch.cab\")
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab (http://\"http://acs.pandasoftware.com/activescan/as5free/asinst.cab\")
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab (http://\"http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab\")
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab (http://\"http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab\")
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = osservice.com
O17 - HKLM\Software\..\Telephony: DomainName = osservice.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = osservice.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

the computer seems to be running fine, limewire no longers opens up on its own. I still get spyware to show up in the ad aware scan, but for the most part things seem to be ok. (except for that new virus)

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: guestolo on December 11, 2006, 09:25:00 PM

Let's try the following please

Go to START>>All Programs>>Accessories>>System Tools>>System Restore
Create a New restore point
Name it and click create
When that's done

Go to START>>RUN>>type the following
cleanmgr
Hit OK
Let if finish calculating

Select the 'More Options' tab
and click Cleanup... under System Restore
This will clear all later restore points except for the one you just made

Ok the prompts, it may take a few seconds to remove old restore points
Ok again after it's ready and let it finish cleaning

Ensure that Avast is updated and run a Full scan
Let it fix whatever it finds, reboot the computer afterwards
If it finds something, can you note what folder it's located in and the name of the file please

Quote

I still get spyware to show up in the ad aware scan, but for the most part things seem to be ok.

Can you run a fresh scan with Ad-Aware
When it's finished scanning
Click Show Logfile
Right click in the log and choose Select All
Then right click and choose Copy to Clipboard

Come back here and Paste that log to a reply please

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: shantalita on December 13, 2006, 02:13:12 AM

the file from avast is: c:\windows\system32\activescan\pskavs.dll
it says it's malware: win32:CTX

as from as ad-aware goes, here's the log:
Ad-Aware SE Build 1.06r1
Logfile Created on:Tuesday, December 12, 2006 10:53:45 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R139 12.12.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):17 total references
Tracking Cookie(TAC index:3):7 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


12-12-2006 10:53:45 PM - Scan started. (Full System Scan)

 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\shantal\Application Data\microsoft\office\recent
    Description        : list of recently opened documents using microsoft office


 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\shantal\recent
    Description        : list of recently opened documents


 MRU List Object Recognized!
    Location:          : software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct3d


 MRU List Object Recognized!
    Location:          : software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct X


 MRU List Object Recognized!
    Location:          : software\microsoft\directdraw\mostrecentapplication
    Description        : most recent application to use microsoft directdraw


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\directinput\mostrecentapplication
    Description        : most recent application to use microsoft directinput


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\directinput\mostrecentapplication
    Description        : most recent application to use microsoft directinput


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\internet explorer\typedurls
    Description        : list of recently entered addresses in microsoft internet explorer


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\mediaplayer\player\recentfilelist
    Description        : list of recently used files in microsoft windows media player


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\mediaplayer\preferences
    Description        : last playlist index loaded in microsoft windows media player


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\mediaplayer\preferences
    Description        : last playlist loaded in microsoft windows media player


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\microsoft management console\recent file list
    Description        : list of recent snap-ins used in the microsoft management console


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
    Description        : list of recent programs opened


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
    Description        : list of recently saved files, stored according to file extension


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\windows\currentversion\explorer\recentdocs
    Description        : list of recent documents opened


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\windows\currentversion\explorer\runmru
    Description        : mru list for items opened in start | run


 MRU List Object Recognized!
    Location:          : S-1-5-21-3232988777-1668688258-2627283247-1129\software\microsoft\windows media\wmsdk\general
    Description        : windows media sdk


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
    FilePath           : \SystemRoot\System32\
    ProcessID          : 776
    ThreadCreationTime : 12-13-2006 6:41:56 AM
    BasePriority       : Normal


#:2 [csrss.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 848
    ThreadCreationTime : 12-13-2006 6:41:58 AM
    BasePriority       : Normal


#:3 [winlogon.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 872
    ThreadCreationTime : 12-13-2006 6:42:00 AM
    BasePriority       : High


#:4 [services.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 916
    ThreadCreationTime : 12-13-2006 6:42:00 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Services and Controller app
    InternalName       : services.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : services.exe

#:5 [lsass.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 928
    ThreadCreationTime : 12-13-2006 6:42:00 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName       : lsass.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : lsass.exe

#:6 [ati2evxx.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1080
    ThreadCreationTime : 12-13-2006 6:42:01 AM
    BasePriority       : Normal


#:7 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1092
    ThreadCreationTime : 12-13-2006 6:42:01 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:8 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1184
    ThreadCreationTime : 12-13-2006 6:42:01 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:9 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1220
    ThreadCreationTime : 12-13-2006 6:42:01 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:10 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1268
    ThreadCreationTime : 12-13-2006 6:42:02 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:11 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1364
    ThreadCreationTime : 12-13-2006 6:42:02 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:12 [wltrysvc.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1564
    ThreadCreationTime : 12-13-2006 6:42:02 AM
    BasePriority       : Normal


#:13 [bcmwltry.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1576
    ThreadCreationTime : 12-13-2006 6:42:02 AM
    BasePriority       : Normal
    FileVersion        : 4.10.47.3
    ProductVersion     : 4.10.47.3
    ProductName        : Dell Wireless WLAN Card Wireless Network Controller
    CompanyName        : Dell Inc.
    FileDescription    : Dell Wireless WLAN Card Wireless Network Controller
    InternalName       : bcmwltry.exe
    LegalCopyright     : 1998-2005, Dell Inc. All Rights Reserved.
    OriginalFilename   : bcmwltry.exe

#:14 [lexbces.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1628
    ThreadCreationTime : 12-13-2006 6:42:02 AM
    BasePriority       : Normal
    FileVersion        : 9.45
    ProductVersion     : 9.45
    ProductName        : MarkVision for Windows (32 bit)
    CompanyName        : Lexmark International, Inc.
    FileDescription    : LexBce Service
    InternalName       : LexBce Service
    LegalCopyright     : © 1993 - 2004 Lexmark International, Inc.
    OriginalFilename   : LexBceS.exe

#:15 [spoolsv.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1664
    ThreadCreationTime : 12-13-2006 6:42:02 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
    ProductVersion     : 5.1.2600.2696
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Spooler SubSystem App
    InternalName       : spoolsv.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : spoolsv.exe

#:16 [lexpps.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1704
    ThreadCreationTime : 12-13-2006 6:42:02 AM
    BasePriority       : Normal
    FileVersion        : 9.45
    ProductVersion     : 9.45
    ProductName        : MarkVision for Windows (32 bit)
    CompanyName        : Lexmark International, Inc.
    FileDescription    : LEXPPS.EXE
    InternalName       : LEXPPS
    LegalCopyright     : © 1993 - 2004 Lexmark International, Inc.
    OriginalFilename   : LEXPPS.EXE
    Comments           : MarkVision for Windows '95 New P2P Server  (32-bit)

#:17 [aswupdsv.exe]
    FilePath           : C:\Program Files\Alwil Software\Avast4\
    ProcessID          : 1860
    ThreadCreationTime : 12-13-2006 6:42:03 AM
    BasePriority       : Normal


#:18 [ashserv.exe]
    FilePath           : C:\Program Files\Alwil Software\Avast4\
    ProcessID          : 1872
    ThreadCreationTime : 12-13-2006 6:42:03 AM
    BasePriority       : High
    FileVersion        : 4, 7, 889, 0
    ProductVersion     : 4, 7, 0, 0
    ProductName        : avast! Antivirus
    FileDescription    : avast! antivirus service
    InternalName       : aswServ
    LegalCopyright     : Copyright © 2006 ALWIL Software
    OriginalFilename   : aswServ.exe

#:19 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 2020
    ThreadCreationTime : 12-13-2006 6:42:03 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:20 [ashmaisv.exe]
    FilePath           : C:\Program Files\Alwil Software\Avast4\
    ProcessID          : 528
    ThreadCreationTime : 12-13-2006 6:42:07 AM
    BasePriority       : Normal


#:21 [ashwebsv.exe]
    FilePath           : C:\Program Files\Alwil Software\Avast4\
    ProcessID          : 544
    ThreadCreationTime : 12-13-2006 6:42:07 AM
    BasePriority       : Normal


#:22 [alg.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 796
    ThreadCreationTime : 12-13-2006 6:42:09 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Application Layer Gateway Service
    InternalName       : ALG.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : ALG.exe

#:23 [explorer.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1448
    ThreadCreationTime : 12-13-2006 6:42:10 AM
    BasePriority       : Normal
    FileVersion        : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 6.00.2900.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Explorer
    InternalName       : explorer
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : EXPLORER.EXE

#:24 [atiptaxx.exe]
    FilePath           : C:\Program Files\ATI Technologies\ATI Control Panel\
    ProcessID          : 920
    ThreadCreationTime : 12-13-2006 6:42:14 AM
    BasePriority       : Normal
    FileVersion        : 6.14.10.5028
    ProductVersion     : 6.14.10.5028
    ProductName        : ATI Desktop Component
    CompanyName        : ATI Technologies, Inc.
    FileDescription    : ATI Desktop Control Panel
    InternalName       : Atiptaxx.exe
    LegalCopyright     : Copyright © 1998-2002 ATI Technologies Inc.
    OriginalFilename   : Atiptaxx.exe

#:25 [wltray.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 672
    ThreadCreationTime : 12-13-2006 6:42:14 AM
    BasePriority       : Normal
    FileVersion        : 4.10.47.3
    ProductVersion     : 4.10.47.3
    ProductName        : Dell Wireless WLAN Card Wireless Network Tray Applet
    CompanyName        : Dell Inc.
    FileDescription    : Dell Wireless WLAN Card Wireless Network Tray Applet
    InternalName       : wltray.exe
    LegalCopyright     : 1998-2005, Dell Inc. All Rights Reserved.
    OriginalFilename   : wltray.exe

#:26 [syntplpr.exe]
    FilePath           : C:\Program Files\Synaptics\SynTP\
    ProcessID          : 696
    ThreadCreationTime : 12-13-2006 6:42:14 AM
    BasePriority       : Normal
    FileVersion        : 7.10.11 13May04
    ProductVersion     : 7.10.11 13May04
    ProductName        : Progressive Touch
    CompanyName        : Synaptics, Inc.
    FileDescription    : TouchPad Driver Helper Application
    InternalName       : SynTPLpr
    LegalCopyright     : Copyright © Synaptics, Inc. 1996-2004
    OriginalFilename   : SynTPLpr.exe

#:27 [syntpenh.exe]
    FilePath           : C:\Program Files\Synaptics\SynTP\
    ProcessID          : 720
    ThreadCreationTime : 12-13-2006 6:42:15 AM
    BasePriority       : Normal
    FileVersion        : 7.10.11 13May04
    ProductVersion     : 7.10.11 13May04
    ProductName        : Progressive Touch
    CompanyName        : Synaptics, Inc.
    FileDescription    : Synaptics TouchPad Enhancements
    InternalName       : Scrolleroo
    LegalCopyright     : Copyright © Synaptics, Inc. 1996-2004
    OriginalFilename   : SynTPEnh.exe

#:28 [hpztsb07.exe]
    FilePath           : C:\WINDOWS\system32\spool\drivers\w32x86\3\
    ProcessID          : 484
    ThreadCreationTime : 12-13-2006 6:42:15 AM
    BasePriority       : Normal
    FileVersion        : 2,140,0,0
    ProductVersion     : 2,140,0,0
    ProductName        : HP DeskJet
    CompanyName        : HP
    LegalCopyright     : Copyright © Hewlett-Packard Company 1999-2002

#:29 [gnotify.exe]
    FilePath           : C:\Program Files\Google\Gmail Notifier\
    ProcessID          : 2056
    ThreadCreationTime : 12-13-2006 6:42:15 AM
    BasePriority       : Normal
    FileVersion        : 1.0.25.0
    ProductVersion     : 1.0.25.0
    ProductName        : Gmail
    CompanyName        : Google Inc.
    FileDescription    : Gmail Notifier
    LegalCopyright     : Copyright © Google Inc. 2004-2005
    OriginalFilename   : gnotify.exe

#:30 [qttask.exe]
    FilePath           : C:\Program Files\QuickTime\
    ProcessID          : 2488
    ThreadCreationTime : 12-13-2006 6:42:16 AM
    BasePriority       : Normal
    FileVersion        : 7.0.3
    ProductVersion     : QuickTime 7.0.3
    ProductName        : QuickTime
    CompanyName        : Apple Computer, Inc.
    FileDescription    : QuickTime Task
    InternalName       : QuickTime Task
    LegalCopyright     : Copyright Apple Computer, Inc. 1989-2005
    OriginalFilename   : QTTask.exe

#:31 [realsched.exe]
    FilePath           : C:\Program Files\Common Files\Real\Update_OB\
    ProcessID          : 2660
    ThreadCreationTime : 12-13-2006 6:42:19 AM
    BasePriority       : Normal
    FileVersion        : 0.1.0.3492
    ProductVersion     : 0.1.0.3492
    ProductName        : RealPlayer (32-bit)
    CompanyName        : RealNetworks, Inc.
    FileDescription    : RealNetworks Scheduler
    InternalName       : schedapp
    LegalCopyright     : Copyright © RealNetworks, Inc. 1995-2004
    LegalTrademarks    : RealAudio(tm) is a trademark of RealNetworks, Inc.
    OriginalFilename   : realsched.exe

#:32 [ituneshelper.exe]
    FilePath           : C:\Program Files\iTunes\
    ProcessID          : 2772
    ThreadCreationTime : 12-13-2006 6:42:19 AM
    BasePriority       : Normal
    FileVersion        : 6.0.2.23
    ProductVersion     : 6.0.2.23
    ProductName        : iTunes
    CompanyName        : Apple Computer, Inc.
    FileDescription    : iTunesHelper Module
    InternalName       : iTunesHelper
    LegalCopyright     : © 2003-2006 Apple Computer, Inc. All Rights Reserved.
    OriginalFilename   : iTunesHelper.exe

#:33 [bcmsmmsg.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 2816
    ThreadCreationTime : 12-13-2006 6:42:19 AM
    BasePriority       : Normal
    FileVersion        :  3.5.25 08/27/2003 20:04:35
    ProductVersion     :  3.5.25 08/27/2003 20:04:35
    ProductName        : BCM Modem Messaging Applet
    CompanyName        : Broadcom Corporation
    FileDescription    : Modem Messaging Applet
    InternalName       : smdmstat.exe
    LegalCopyright     : Copyright © Broadcom Corporation 1998-2000
    OriginalFilename   : smdmstat.exe

#:34 [hpwuschd2.exe]
    FilePath           : C:\Program Files\HP\HP Software Update\
    ProcessID          : 2868
    ThreadCreationTime : 12-13-2006 6:42:19 AM
    BasePriority       : Normal
    FileVersion        : 70.0.170.000
    ProductVersion     : 070.000.170.000
    ProductName        : hp digital imaging
    CompanyName        : Hewlett-Packard Development Company, L.P.
    FileDescription    : Hewlett-Packard Product Assistant
    InternalName       : hpwuSchd2
    LegalCopyright     : Copyright © Hewlett-Packard Development Company, L.P. 1995-2005
    OriginalFilename   : hpwuSchd2.exe
    Comments           : Hewlett-Packard Product Assistant

#:35 [ipodservice.exe]
    FilePath           : C:\Program Files\iPod\bin\
    ProcessID          : 2884
    ThreadCreationTime : 12-13-2006 6:42:19 AM
    BasePriority       : Normal
    FileVersion        : 6.0.2.23
    ProductVersion     : 6.0.2.23
    ProductName        : iTunes
    CompanyName        : Apple Computer, Inc.
    FileDescription    : iPodService Module
    InternalName       : iPodService
    LegalCopyright     : © 2003-2006 Apple Computer, Inc. All Rights Reserved.
    OriginalFilename   : iPodService.exe

#:36 [jusched.exe]
    FilePath           : C:\Program Files\Java\jre1.5.0_10\bin\
    ProcessID          : 2944
    ThreadCreationTime : 12-13-2006 6:42:19 AM
    BasePriority       : Normal


#:37 [ashdisp.exe]
    FilePath           : C:\PROGRA~1\ALWILS~1\Avast4\
    ProcessID          : 3028
    ThreadCreationTime : 12-13-2006 6:42:20 AM
    BasePriority       : Normal
    FileVersion        : 5, 0, 0, 0
    ProductVersion     : 5, 0, 0, 0
    ProductName        : avast! Antivirus
    FileDescription    : avast! service GUI component
    InternalName       : aswDisp
    LegalCopyright     : Copyright © 2006 ALWIL Software
    OriginalFilename   : aswDisp.exe

#:38 [aim.exe]
    FilePath           : C:\Program Files\AIM\
    ProcessID          : 3100
    ThreadCreationTime : 12-13-2006 6:42:20 AM
    BasePriority       : Normal
    FileVersion        : 5.9.6089
    ProductVersion     : 5.9.6089
    ProductName        : AOL Instant Messenger
    CompanyName        : America Online, Inc.
    FileDescription    : AOL Instant Messenger
    InternalName       : AIM
    LegalCopyright     : Copyright © 1996-2006 America Online, Inc.
    OriginalFilename   : AIM.EXE

#:39 [msnmsgr.exe]
    FilePath           : C:\Program Files\MSN Messenger\
    ProcessID          : 3116
    ThreadCreationTime : 12-13-2006 6:42:20 AM
    BasePriority       : Normal
    FileVersion        : 7.5.0324
    ProductVersion     : 7.5.0324
    ProductName        : MSN Messenger
    CompanyName        : Microsoft Corporation
    FileDescription    : MSN Messenger
    InternalName       : msnmsgr
    LegalCopyright     : Copyright © Microsoft Corporation 1997-2004
    LegalTrademarks    : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
    OriginalFilename   : msnmsgr.exe

#:40 [gcasdtserv.exe]
    FilePath           : C:\Program Files\Microsoft AntiSpyware\
    ProcessID          : 3216
    ThreadCreationTime : 12-13-2006 6:42:21 AM
    BasePriority       : Normal
    FileVersion        : 1.00.0701
    ProductVersion     : 1.00.0701
    ProductName        : Microsoft AntiSpyware (Beta 1)
    CompanyName        : Microsoft Corporation
    FileDescription    : Microsoft AntiSpyware Data Service
    InternalName       : gcasDtServ
    LegalCopyright     : Copyright © 2004-2005 Microsoft Corporation. All rights reserved.
    LegalTrademarks    : Microsoft® and Windows® are registered trademarks of Microsoft Corporation. SpyNet(tm) is a trademark of Microsoft Corporation.
    OriginalFilename   : gcasDtServ.exe

#:41 [googletalk.exe]
    FilePath           : C:\Program Files\Google\Google Talk\
    ProcessID          : 3232
    ThreadCreationTime : 12-13-2006 6:42:21 AM
    BasePriority       : Normal
    FileVersion        : 1,0,0,100
    ProductVersion     : 1,0,0,100
    ProductName        : Google Talk
    CompanyName        : Google
    FileDescription    : Google Talk
    InternalName       : Google Talk
    LegalCopyright     : Copyright © 2005-2006
    OriginalFilename   : googletalk.exe

#:42 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 3424
    ThreadCreationTime : 12-13-2006 6:42:23 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:43 [hpqtra08.exe]
    FilePath           : C:\Program Files\HP\Digital Imaging\bin\
    ProcessID          : 1768
    ThreadCreationTime : 12-13-2006 6:42:56 AM
    BasePriority       : Normal
    FileVersion        : 70.0.170.000
    ProductVersion     : 070.000.170.000
    ProductName        : hp digital imaging
    CompanyName        : Hewlett-Packard Development Company, L.P.
    FileDescription    : HP Digital Imaging Monitor
    InternalName       : HPQTRA00
    LegalCopyright     : Copyright © Hewlett-Packard Development Company, L.P. 1995-2005
    OriginalFilename   : HPQTRA00.EXE
    Comments           : HP Digital Imaging Monitor

#:44 [webshots.scr]
    FilePath           : C:\PROGRA~1\Webshots\
    ProcessID          : 2236
    ThreadCreationTime : 12-13-2006 6:43:01 AM
    BasePriority       : Normal
    FileVersion        : 2, 5, 1, 7008
    ProductVersion     : 2, 5, 1, 7008
    ProductName        : The Webshots Desktop
    CompanyName        : Webshots.com
    FileDescription    : Webshots Photo Manager
    InternalName       : Webshots2
    LegalCopyright     : Copyright © 2006
    OriginalFilename   : Webshots2.SCR

#:45 [hpqimzone.exe]
    FilePath           : C:\Program Files\HP\Digital Imaging\bin\
    ProcessID          : 2668
    ThreadCreationTime : 12-13-2006 6:43:13 AM
    BasePriority       : Normal


#:46 [hpqste08.exe]
    FilePath           : C:\Program Files\HP\Digital Imaging\bin\
    ProcessID          : 2800
    ThreadCreationTime : 12-13-2006 6:43:19 AM
    BasePriority       : Normal
    FileVersion        : 70.0.170.000
    ProductVersion     : 070.000.170.000
    ProductName        : hp digital imaging
    CompanyName        : Hewlett-Packard Development Company, L.P.
    FileDescription    : HP CUE Status
    InternalName       : HPQSTS00
    LegalCopyright     : Copyright © Hewlett-Packard Development Company, L.P. 1995-2005
    OriginalFilename   : HPQSTS00.EXE
    Comments           : HP CUE Status

#:47 [itunes.exe]
    FilePath           : C:\Program Files\iTunes\
    ProcessID          : 328
    ThreadCreationTime : 12-13-2006 6:46:06 AM
    BasePriority       : Normal
    FileVersion        : 6.0.2.23
    ProductVersion     : 6.0.2.23
    ProductName        : iTunes
    CompanyName        : Apple Computer, Inc.
    FileDescription    : iTunes
    InternalName       : iTunes
    LegalCopyright     : © 2003-2006 Apple Computer, Inc. All Rights Reserved.
    OriginalFilename   : iTunes.exe

#:48 [ad-aware.exe]
    FilePath           : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
    ProcessID          : 2380
    ThreadCreationTime : 12-13-2006 6:52:50 AM
    BasePriority       : Normal
    FileVersion        : 6.2.0.236
    ProductVersion     : SE 106
    ProductName        : Lavasoft Ad-Aware SE
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-Aware SE Core application
    InternalName       : Ad-Aware.exe
    LegalCopyright     : Copyright © Lavasoft AB Sweden
    OriginalFilename   : Ad-Aware.exe
    Comments           : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 17


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 17


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 17


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : shantal@atdmt[2].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:17
    Value              : Cookie:[email protected]/
    Expires            : 12-9-2011 4:00:00 PM
    LastSync           : Hits:17
    UseCount           : 0
    Hits               : 17

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : shantal@hitbox[2].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:8
    Value              : Cookie:[email protected]/
    Expires            : 12-10-2007 10:37:58 PM
    LastSync           : Hits:8
    UseCount           : 0
    Hits               : 8

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : shantal@mediaplex[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:7
    Value              : Cookie:[email protected]/
    Expires            : 6-21-2009 4:00:00 PM
    LastSync           : Hits:7
    UseCount           : 0
    Hits               : 7

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : shantal@doubleclick[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:20
    Value              : Cookie:[email protected]/
    Expires            : 12-9-2009 10:13:14 PM
    LastSync           : Hits:20
    UseCount           : 0
    Hits               : 20

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : shantal@questionmarket[2].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:17
    Value              : Cookie:[email protected]/
    Expires            : 2-2-2008 10:04:56 AM
    LastSync           : Hits:17
    UseCount           : 0
    Hits               : 17

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : shantal@advertising[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:21
    Value              : Cookie:[email protected]/
    Expires            : 12-10-2011 10:57:20 AM
    LastSync           : Hits:21
    UseCount           : 0
    Hits               : 21

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : [email protected][1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:15
    Value              : Cookie:[email protected]/
    Expires            : 12-10-2007 10:37:58 PM
    LastSync           : Hits:15
    UseCount           : 0
    Hits               : 15

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 7
Objects found so far: 24



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 24


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 24




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 24

11:08:53 PM Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:15:07.795
Objects scanned:168967
Objects identified:7
Objects ignored:0
New critical objects:7

Title: help with : WIN32.P2P-WORM.ALCAN.A
Post by: guestolo on December 14, 2006, 08:32:23 PM

I'll try to post what I can, I'm having problems posting to the forum lately

Nothing bad found by Avast
Actually, the file found bad by Avast is related to Panda Activescan
It's a false positive

The cookies found by Ad-Aware are also nothing to worry about
You can clear your cookies and cache

I would also
*Install  SpywareBlaster 3.5.1 by JavaCool  

*Will block bad ActiveX Controls
*Block Malevolent cookies in Internet Explorer and Firefox
*Restrict actions of potentially dangerous sites in Internet Explorer

After installation, Check for updates
After updating, select "Protection" on the Left
Then select "Enable all Protection"
"Check for updates every couple of weeks"
after every update just simply click the "enable protection on all unprotected items"

I can't seem to post a link to SpywareBlaster at this time, I'm having some problems posting links
If you google
SpywareBlaster 3.5.1
Copy>>paste that to Google
The very top search result will give you more info and Download links to the program
It's yours for free