Messages

1

Tech Clinic / virus?

« on: January 18, 2007, 03:32:52 PM »

thinga are doing better. the computer hasnt shut off unexpectedly. we have dsl and the network goes off a lot. i dont know if this is a computer problem or a problem with the provider. i dont think i have seen a lot of pop ups

2

Tech Clinic / virus?

« on: January 18, 2007, 03:23:48 PM »

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\epwpawyg

*******************

Script file located at: \??\C:\WINDOWS\system32\mrwbixri.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\dvkenghk.dll deleted successfully.
File C:\WINDOWS\system32\chheengb.dll deleted successfully.
File C:\WINDOWS\system32\iovbdqgx.dll deleted successfully.
File C:\WINDOWS\system32\vuvdkeaq.dll deleted successfully.
File C:\WINDOWS\system32\akjkuenm.dll deleted successfully.
File C:\WINDOWS\system32\msbhmfow.dll deleted successfully.
File C:\WINDOWS\system32\fcjbighr.dll deleted successfully.
File C:\WINDOWS\system32\jqbargpy.dll deleted successfully.
File C:\WINDOWS\system32\auwnjdkh.dll deleted successfully.
File C:\WINDOWS\system32\lxfdvhnu.dll deleted successfully.
File C:\WINDOWS\system32\pleqjput.dll deleted successfully.
File C:\WINDOWS\system32\bkxdihgx.dll deleted successfully.
File C:\WINDOWS\system32\nmypsyfy.dll deleted successfully.
File C:\WINDOWS\system32\lonxighk.dll deleted successfully.
File C:\WINDOWS\system32\ntfhowex.dll deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb1942.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb4827.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb9912.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb715.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb5436.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb4179.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb2391.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb1869.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb8467.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb41.dat deleted successfully.
File C:\Documents and Settings\Owner\Application Data\internaldb6334.dat deleted successfully.
File C:\WINDOWS\7-7c15eb3352bcc3049d7e9e974ad283bf.exe deleted successfully.
File C:\Documents and Settings\Owner\Application Data\inifile41.ini deleted successfully.
Folder C:\WINDOWS\system32\SmartShopper deleted successfully.
Folder C:\Program Files\VSAdd-in deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97D364E2-614A-4160-8127-CDE889EDA420} deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

3

Tech Clinic / virus?

« on: January 18, 2007, 03:22:38 PM »

Logfile of HijackThis v1.99.1
Scan saved at 12:21:53 PM, on 1/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\BigFix\bigfix.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HJT\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Mercora] "C:\Program Files\Mercora\MercoraClient.exe" -min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Torrent Finder] "C:\Program Files\Torrent Finder\Torrent-Finder.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

4

Tech Clinic / virus?

« on: January 17, 2007, 01:46:17 AM »

Owner - 07-01-16 22:40:14.03    Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Owner\Desktop"

(((((((((((((((((((((((((((((((   Files Created from 2006-12-16 to 2007-01-16  ))))))))))))))))))))))))))))))))))
 
 
2007-01-16   21:04   3,968   --a------   C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-16   21:04   <DIR>   d--------   C:\Program Files\Grisoft
2007-01-16   21:02   <DIR>   d--------   C:\Program Files\Common Files\Java
2007-01-13   19:37   <DIR>   d--------   C:\Program Files\Photo_Resizer_Pro
2007-01-10   19:33   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-01-10   10:12   <DIR>   d--------   C:\VundoFix Backups
2007-01-08   18:11   81,684   --a------   C:\WINDOWS\system32\dvkenghk.dll
2007-01-08   16:54   81,684   --a------   C:\WINDOWS\system32\chheengb.dll
2007-01-05   12:33   81,684   --a------   C:\WINDOWS\system32\iovbdqgx.dll
2007-01-04   12:24   81,684   --a------   C:\WINDOWS\system32\vuvdkeaq.dll
2007-01-01   19:22   <DIR>   d--------   C:\HJT
2006-12-30   19:50   <DIR>   d--------   C:\Program Files\_ArcadeDownloadFolder
2006-12-29   19:10   <DIR>   d--------   C:\My Backup -- 06-12-29 0810PM
2006-12-29   10:40   81,684   --a------   C:\WINDOWS\system32\akjkuenm.dll
2006-12-28   10:05   44,060   --a------   C:\WINDOWS\system32\msbhmfow.dll
2006-12-28   10:04   81,684   --a------   C:\WINDOWS\system32\fcjbighr.dll
2006-12-27   17:25   44,060   --a------   C:\WINDOWS\system32\jqbargpy.dll
2006-12-27   16:21   44,060   --a------   C:\WINDOWS\system32\auwnjdkh.dll
2006-12-27   15:15   44,060   --a------   C:\WINDOWS\system32\lxfdvhnu.dll
2006-12-27   14:48   44,060   --a------   C:\WINDOWS\system32\pleqjput.dll
2006-12-22   22:45   81,684   --a------   C:\WINDOWS\system32\bkxdihgx.dll
2006-12-19   16:37   81,684   --a------   C:\WINDOWS\system32\nmypsyfy.dll


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-16 22:26   --------   d--------   C:\Program Files\Mozilla Firefox
2007-01-16 21:02   --------   d--------   C:\Program Files\Java
2007-01-16 21:02   --------   d--------   C:\Program Files\Common Files
2007-01-16 20:55   382   --a------   C:\Documents and Settings\Owner\Application Data\internaldb1942.dat
2007-01-15 16:14   --------   d--------   C:\Program Files\Common Files\Symantec Shared
2007-01-10 14:12   2560   --a------   C:\WINDOWS\system32\BitCometRes.dll
2007-01-10 14:12   --------   d--------   C:\Program Files\BitComet
2007-01-10 10:04   69632   --a------   C:\Documents and Settings\Owner\Application Data\internaldb4827.dat
2007-01-10 10:04   151   --a------   C:\Documents and Settings\Owner\Application Data\internaldb9912.dat
2007-01-10 10:04   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb715.dat
2007-01-03 08:36   --------   d--------   C:\Program Files\LimeWire
2006-12-31 18:52   --------   d--------   C:\Program Files\Google
2006-12-31 15:54   --------   d--------   C:\Program Files\Common Files\Adobe
2006-12-31 15:54   --------   d--------   C:\Program Files\Adobe
2006-12-30 19:50   --------   d--------   C:\Program Files\_ArcadeDownloadFolder
2006-12-27 16:02   --------   d--------   C:\Program Files\VSAdd-in
2006-12-27 14:59   --------   d--------   C:\Program Files\Soulseek
2006-12-15 18:13   --------   d--------   C:\Program Files\Blubster
2006-12-15 14:18   --------   d--------   C:\Program Files\Internet Explorer
2006-12-15 10:18   --------   d--------   C:\Program Files\Common Files\System
2006-12-15 10:13   --------   d--------   C:\Program Files\Outlook Express
2006-12-14 16:28   118804   --a------   C:\WINDOWS\system32\lonxighk.dll
2006-12-14 15:02   118804   --a------   C:\WINDOWS\system32\ntfhowex.dll
2006-12-07 01:44   --------   d--------   C:\Documents and Settings\Owner\Application Data\CyberLink
2006-12-06 22:40   2362184   --a------   C:\WINDOWS\system32\wmvcore.dll
2006-11-28 09:54   --------   d--------   C:\Program Files\Pure Networks
2006-11-28 09:21   --------   d--------   C:\Program Files\BitTorrent
2006-11-28 09:17   --------   d--------   C:\Documents and Settings\Owner\Application Data\BitTorrent
2006-11-28 09:11   --------   d--------   C:\Program Files\Common Files\AOL
2006-11-28 09:10   --------   d--------   C:\Documents and Settings\Owner\Application Data\AOL
2006-11-26 20:31   --------   d--------   C:\Documents and Settings\Owner\Application Data\Adobe
2006-11-25 19:01   --------   d--------   C:\Documents and Settings\Owner\Application Data\Creative
2006-11-24 08:14   --------   d--------   C:\Program Files\Creative
2006-11-24 08:12   --------   d--h-----   C:\Program Files\InstallShield Installation Information
2006-11-24 08:05   --------   d--------   C:\Program Files\Windows Media Player
2006-11-22 18:03   --------   d--------   C:\Documents and Settings\Owner\Application Data\vlc
2006-11-20 20:37   --------   d--------   C:\Program Files\Common Files\Vbox
2006-11-20 20:23   --------   d--------   C:\Documents and Settings\Owner\Application Data\Leadertech
2006-11-20 20:05   --------   d--------   C:\Documents and Settings\Owner\Application Data\AdobeAUM
2006-11-19 19:37   --------   d--------   C:\Program Files\VideoLAN
2006-11-18 13:26   --------   d--------   C:\Program Files\MSXML 4.0
2006-11-17 18:34   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb5436.dat
2006-11-17 15:34   --------   d---s----   C:\Documents and Settings\Owner\Application Data\Microsoft
2006-11-15 15:54   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb4179.dat
2006-11-15 15:54   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb2391.dat
2006-11-15 15:54   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb1869.dat
2006-11-12 00:32   9216   --a------   C:\Documents and Settings\Owner\Application Data\internaldb8467.dat
2006-11-12 00:32   49   --a------   C:\Documents and Settings\Owner\Application Data\internaldb41.dat
2006-11-12 00:32   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb6334.dat
2006-11-12 00:31   365132   --a------   C:\WINDOWS\7-7c15eb3352bcc3049d7e9e974ad283bf.exe
2006-11-12 00:31   23   --a------   C:\Documents and Settings\Owner\Application Data\inifile41.ini
2006-11-07 21:06   679424   --a------   C:\WINDOWS\system32\inetcomm.dll
2006-11-04 14:14   1245696   --a------   C:\WINDOWS\system32\msxml4.dll
2006-10-19 20:09   0   --a------   C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2006-10-19 05:56   713216   --a------   C:\WINDOWS\system32\sxs.dll
 
 
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Mercora"="\"C:\\Program Files\\Mercora\\MercoraClient.exe\" -min"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Torrent Finder"="\"C:\\Program Files\\Torrent Finder\\Torrent-Finder.exe\""
"updateMgr"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1"
"Creative Detector"="\"C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe\" /R"
"BitTorrent"="\"C:\\Program Files\\BitTorrent\\bittorrent.exe\" --force_start_minimized"
"Power2GoExpress"=""
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.2480\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"SoundMan"="SOUNDMAN.EXE"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"Recguard"=hex(2):25,57,49,4e,44,49,52,25,5c,53,4d,49,4e,53,54,5c,52,45,43,47,\
  55,41,52,44,2e,45,58,45,00
"Reminder"=hex(2):25,57,49,4e,44,49,52,25,5c,43,72,65,61,74,6f,72,5c,52,65,6d,\
  69,6e,64,5f,58,50,2e,65,78,65,00
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"osCheck"="\"C:\\Program Files\\Norton AntiVirus\\osCheck.exe\""
"D-Link AirPlus XtremeG"="C:\\Program Files\\D-Link\\AirPlus XtremeG\\AirPlusCFG.exe"
"ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"AGEIA PhysX SysTray"="\"C:\\Program Files\\AGEIA Technologies\\TrayIcon.exe\""
"MSKDetectorExe"="C:\\Program Files\\McAfee\\SpamKiller\\MSKDetct.exe /uninstall"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0\\bin\\jusched.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000004

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,ec,\
  03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
  00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
  00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Power2GoExpress"="NA"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Power2GoExpress"="NA"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]   
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

 
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Owner.job

Completion time: 07-01-16 22:43:02.10
C:\ComboFix.txt ... 07-01-16 22:43
C:\ComboFix2.txt ... 07-01-09 11:08

5

Tech Clinic / virus?

« on: January 17, 2007, 01:38:22 AM »

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

 + Created at:   10:18:19 PM 1/16/2007

 + Scan result:   



C:\Program Files\n-CASE -> Adware.180Solutions : Cleaned.
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP63\A0177546.dll -> Adware.AdvertMen : Cleaned.
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP63\A0177548.dll -> Adware.AdvertMen : Cleaned.
C:\HJT\backups\backup-20070110-101018-427.dll -> Adware.Beginto : Cleaned.
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP71\A0215548.dll -> Adware.Beginto : Cleaned.
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP66\A0187680.sys -> Adware.BetterInternet : Cleaned.
C:\WINDOWS\4-efb7bab6499fc415ee93f4097033deae.exe -> Adware.SmartShoppe : Cleaned.
C:\WINDOWS\system32\SmartShopper\SmartShopper0.dll -> Adware.SmartShoppe : Cleaned.
C:\WINDOWS\5-a0c18a429b8010fee34ee31d9073371d.exe -> Adware.TrafficSol : Cleaned.
C:\WINDOWS\system32\vtuspop.dll -> Adware.Virtumonde : Cleaned.
C:\Documents and Settings\Miguel\Local Settings\Temporary Internet Files\Content.IE5\4ZW3K5MT\ad-sp2-fastclick[1].swf -> Not-A-Virus.Hoax.SWF.Alerter.a : Cleaned.
:mozilla.300:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.588:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.250:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.27:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.29:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.325:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.32:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.33:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.34:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.35:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.36:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.37:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.38:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.39:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.40:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.41:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.42:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.43:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.44:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.45:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.46:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.47:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.48:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.49:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.50:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.51:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.52:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.53:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.54:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.55:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.56:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.57:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.58:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.59:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.613:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.670:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.671:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.672:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.673:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.674:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.675:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.676:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.677:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.678:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.679:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.680:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.681:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.682:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.683:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.684:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.685:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.686:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.687:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.688:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.689:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.690:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.691:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.692:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.693:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.694:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.695:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.696:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.697:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.698:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.699:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.700:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.701:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.702:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.703:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.704:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.705:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.720:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.723:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.738:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.786:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.797:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.846:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.872:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.906:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.90:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.91:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.92:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.93:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.94:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.95:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.96:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.97:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.98:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Isidro\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Isidro\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Sandy\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Sandy\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.154:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.155:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.163:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.164:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.165:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.166:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.170:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.292:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.293:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.294:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.295:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.296:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.297:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.298:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.299:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.304:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.330:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.335:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.336:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.431:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.432:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.433:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.434:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.435:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.436:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.437:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.532:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.533:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.534:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.535:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.536:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.537:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.538:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.539:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.540:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Miguel\Cookies\miguel@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.406:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.734:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Isidro\Cookies\[email protected][1].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Miguel\Cookies\[email protected][2].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][2].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Sandy\Cookies\[email protected][2].txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.528:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.529:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@adjuggler[3].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Isidro\Cookies\[email protected][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Isidro\Local Settings\Temp\Cookies\[email protected][1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Miguel\Cookies\miguel@adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Miguel\Cookies\[email protected][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Sandy\Cookies\[email protected][1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Miguel\Cookies\miguel@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@admarketplace[2].txt -> TrackingCookie.Admarketplace : Cleaned.
:mozilla.760:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.761:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.101:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.102:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.103:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.104:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.104:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.105:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.105:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.106:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.106:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.107:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.108:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.109:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.184:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.185:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.186:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.187:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.190:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.194:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.195:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.196:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.197:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.198:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.199:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.264:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.265:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.266:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.267:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.270:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.295:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.296:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.297:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.298:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.299:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.300:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.425:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.426:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.427:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.428:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.429:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.430:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.603:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Isidro\Local Settings\Temp\Cookies\isidro@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Miguel\Cookies\miguel@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.729:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.730:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.777:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.778:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.10:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.11:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.19:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.22:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.23:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.24:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.25:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.35:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.40:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.41:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.42:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.43:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.48:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.49:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.50:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.51:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.52:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.61:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.62:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.63:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.64:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.65:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.7:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.8:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.9:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@advertising[3].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Isidro\Local Settings\Temp\Cookies\isidro@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Miguel\Cookies\miguel@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.100:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.21:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.44:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.45:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.64:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.6:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.89:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Isidro\Local Settings\Temp\Cookies\isidro@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Miguel\Cookies\miguel@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.399:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.465:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.684:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@bfast[2].txt -> TrackingCookie.Bfast : Cleaned.
C:\Documents and Settings\Miguel\Cookies\miguel@bfast[2].txt -> TrackingCookie.Bfast : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@bfast[2].txt -> TrackingCookie.Bfast : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@bfast[2].txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.181:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.262:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.318:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.589:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.635:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.766:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.417:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Isidro\Cookies\[email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Miguel\Cookies\[email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Sandy\Cookies\[email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.413:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.414:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.455:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.456:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.457:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.632:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.633:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Isidro\Cookies\[email protected][2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Miguel\Cookies\[email protected][2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Sandy\Cookies\[email protected][1].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.100:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.101:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.102:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.103:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.104:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.105:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.106:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.106:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.107:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.107:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.108:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.108:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.109:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.109:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.110:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.111:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.112:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.113:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.114:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.115:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.45:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.46:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.47:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.51:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.56:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.57:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.58:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.59:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.69:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.70:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.71:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.72:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.73:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.74:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.75:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.76:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.77:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Isidro\Cookies\isidro@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Isidro\Local Settings\Temp\Cookies\isidro@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Miguel\Cookies\miguel@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Sandy\Cookies\sandy@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Isidro\Cookies\[email protected][1].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Sandy\Cookies\[email protected][2].txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.242:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Com : Cleaned.
:mozilla.303:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.318:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.364:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.643:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Owner\Cookies\owner@com[1].txt -> TrackingCookie.Com : Cleaned.
:mozilla.172:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.222:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies-1.txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.298:C:\Documents and Settings\Miguel\Application Data\Mozilla\Firefox\Profiles\6tm4hhd5.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.597:C:\Documents and Settings\Sandy\Application Data\Mozilla\Firefox\Profiles\raqyjw88.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.626:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lrueosh9.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.807:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
C:\Documents and Settings\Isidro\Cookies\[email protected][1].txt -> TrackingCookie.Coremetrics : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.Coremetrics : Cleaned.
C:\Documents and Settings\Sandy\Cookies\[email protected][1].txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.461:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.462:C:\Documents and Settings\Isidro\Application Data\Mozilla\Firefox\Profiles\4dyd557j.default\cookies.txt -> TrackingCookie.Cpv

6

Tech Clinic / virus?

« on: January 17, 2007, 01:33:18 AM »

Logfile of HijackThis v1.99.1
Scan saved at 10:31:48 PM, on 1/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
C:\Program Files\BigFix\bigfix.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HJT\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {97D364E2-614A-4160-8127-CDE889EDA420} - C:\WINDOWS\system32\vtstt.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Mercora] "C:\Program Files\Mercora\MercoraClient.exe" -min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Torrent Finder] "C:\Program Files\Torrent Finder\Torrent-Finder.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

7

Tech Clinic / virus?

« on: January 10, 2007, 01:34:59 PM »

i dont know why combofix was running from my d drive or how it got on my d drive

8

Tech Clinic / virus?

« on: January 10, 2007, 01:33:18 PM »

INSTALLED SOFTWARE (172) - YOUR-A25ECD8E63 - 1/10/2007 10:32:22 AM

Adobe Reader 7.0.5   Ver: 7.0.5   Installed: 10/9/2006
AGEIA PhysX v2.4.4   
AirPlus XtremeG      Installed: 10/8/2006
AirPlus XtremeG      Installed: 10/8/2006
ANIO Service   
ANIWZCS2 Service   
AppCore   Ver: 1   Installed: 10/8/2006
AV   Ver: 1   Installed: 10/8/2006
Bannercpm Browser Optimizer   Ver: 1.0.5.1
BigFix   
Browser Address Error Redirector   
ccCommon   Ver: 106.0.1.10   Installed: 10/8/2006
Creative MediaSource   Ver: 3.00
Creative Removable Disk Manager   
Creative System Information   
Creative Zen MicroPhoto   Ver: 1.0
DVD Solution   
Google Toolbar for Internet Explorer   
HijackThis 1.99.1   Ver: 1.99.1
Hotfix for Windows XP (KB893357)   Ver: 2
Hotfix for Windows XP (KB895953)   Ver: 4
Hotfix for Windows XP (KB896256)   Ver: 3   Installed: 10/7/2006
Hotfix for Windows XP (KB896344)   Ver: 2
Hotfix for Windows XP (KB906569)   Ver: 2
Internet Worm Protection   Ver: 14.0.0   Installed: 10/8/2006
iTunes   Ver: 7.0.1.8   Installed: 10/9/2006
J2SE Runtime Environment 5.0 Update 2   Ver: 1.5.0.20   Installed: 10/7/2006
LimeWire 4.12.6   Ver: 4.12.6
LiveUpdate 3.1 (Symantec Corporation)   Ver: 3.1.0.99
McAfee Personal Firewall Plus   
McAfee SecurityCenter   
McAfee SpamKiller   
McAfee Uninstall Wizard   
McAfee VirusScan   
Microsoft .NET Framework 2.0   
Microsoft .NET Framework 2.0   Ver: 2.0.50727   Installed: 10/13/2006
Microsoft Digital Image Library 9 - Blocker   Ver: 9.00.0000
Microsoft Digital Image Starter Edition 2006   Ver: 11.0.0422
Microsoft Digital Image Starter Edition 2006 Editor   Ver: 11.0.0422   Installed: 10/7/2006
Microsoft Digital Image Starter Edition 2006 Library   Ver: 11.0.0422   Installed: 10/7/2006
Microsoft Money 2006   Ver: 15
Microsoft Office Standard Edition 2003   Ver: 11.0.6361.0   Installed: 10/7/2006
Microsoft Works   Ver: 08.05.0818   Installed: 10/7/2006
Mozilla Firefox (1.5.0.9)   Ver: 1.5.0.9 (en-US)
MSXML 4.0 SP2 (KB927978)   Ver: 4.20.9841.0   Installed: 11/18/2006
Napster   Ver: 3.0.3.7
Napster Burn Engine   Ver: 2.5.0000   Installed: 10/7/2006
Norton AntiVirus   Ver: 14.0.0.89   Installed: 10/8/2006
Norton AntiVirus (Symantec Corporation)   Ver: 14.0.0.89
Norton AntiVirus Help   Ver: 14.00.00   Installed: 10/8/2006
Norton AntiVirus Parent MSI   Ver: 14.0.0   Installed: 10/8/2006
Norton AntiVirus SYMLT MSI   Ver: 14.0.0   Installed: 10/8/2006
Norton Protection Center   Ver: 2007.1.0.118   Installed: 10/8/2006
NVIDIA Drivers   
Power2Go 4.0   
PowerDVD   
QuickTime   Ver: 7.1.3.130   Installed: 10/9/2006
RealPlayer Basic   
Realtek AC'97 Audio   Ver: 5.17   Installed: 10/7/2006
Recovery Software Suite eMachines   Ver: 1.00.0000   Installed: 10/7/2006
SBC Yahoo! DSL Home Networking Installer   
Search Enhancer   
Security Update for Microsoft .NET Framework 2.0 (KB917283)   Ver: 1
Security Update for Microsoft .NET Framework 2.0 (KB922770)   Ver: 1
Security Update for Step By Step Interactive Training (KB898458)   Ver: 20050502.101010
Security Update for Windows Media Player (KB911564)      Installed: 10/8/2006
Security Update for Windows Media Player 10 (KB917734)      Installed: 10/8/2006
Security Update for Windows Media Player 6.4 (KB925398)      Installed: 12/15/2006
Security Update for Windows XP (KB883939)   Ver: 1
Security Update for Windows XP (KB890046)   Ver: 1
Security Update for Windows XP (KB893756)   Ver: 1
Security Update for Windows XP (KB896358)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB896422)   Ver: 1
Security Update for Windows XP (KB896423)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB896424)   Ver: 1   Installed: 10/7/2006
Security Update for Windows XP (KB896428)   Ver: 1
Security Update for Windows XP (KB896688)   Ver: 1
Security Update for Windows XP (KB899587)   Ver: 1
Security Update for Windows XP (KB899588)   Ver: 1
Security Update for Windows XP (KB899589)   Ver: 1
Security Update for Windows XP (KB899591)   Ver: 1
Security Update for Windows XP (KB900725)   Ver: 1
Security Update for Windows XP (KB901017)   Ver: 1
Security Update for Windows XP (KB901214)   Ver: 1
Security Update for Windows XP (KB902400)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB903235)   Ver: 1
Security Update for Windows XP (KB904706)   Ver: 2   Installed: 10/7/2006
Security Update for Windows XP (KB905414)   Ver: 1
Security Update for Windows XP (KB905749)   Ver: 1
Security Update for Windows XP (KB905915)   Ver: 1   Installed: 10/7/2006
Security Update for Windows XP (KB908519)   Ver: 1   Installed: 10/7/2006
Security Update for Windows XP (KB911562)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB911567)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB911927)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB912919)   Ver: 1   Installed: 10/7/2006
Security Update for Windows XP (KB913580)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB914388)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB914389)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB917159)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB917344)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB917422)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB917953)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB918439)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB918899)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB919007)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB920213)   Ver: 1   Installed: 11/18/2006
Security Update for Windows XP (KB920214)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB920670)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB920683)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB920685)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB921398)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB921883)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB922616)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB922760)   Ver: 1   Installed: 11/18/2006
Security Update for Windows XP (KB922819)   Ver: 1   Installed: 10/13/2006
Security Update for Windows XP (KB923191)   Ver: 1   Installed: 10/13/2006
Security Update for Windows XP (KB923414)   Ver: 1   Installed: 10/13/2006
Security Update for Windows XP (KB923689)      Installed: 12/15/2006
Security Update for Windows XP (KB923694)   Ver: 1   Installed: 12/15/2006
Security Update for Windows XP (KB923980)   Ver: 1   Installed: 11/18/2006
Security Update for Windows XP (KB924191)   Ver: 1   Installed: 10/13/2006
Security Update for Windows XP (KB924270)   Ver: 1   Installed: 11/18/2006
Security Update for Windows XP (KB924496)   Ver: 1   Installed: 10/13/2006
Security Update for Windows XP (KB925454)   Ver: 1   Installed: 12/15/2006
Security Update for Windows XP (KB925486)   Ver: 1   Installed: 10/8/2006
Security Update for Windows XP (KB926255)   Ver: 1   Installed: 12/15/2006
Security Update for Windows XP (KB929969)   Ver: 1   Installed: 1/9/2007
Shockwave Flash   
Soft Data Fax Modem with SmartCP   
SPBBC 32bit   Ver: 3.0.1.10   Installed: 10/8/2006
Symantec   Ver: 11.5.0   Installed: 10/8/2006
Symantec Real Time Storage Protection Component   Ver: 10.0.1.4   Installed: 10/8/2006
SymNet   Ver: 7.0.0.170   Installed: 10/8/2006
Update for Windows XP (KB894391)   Ver: 1
Update for Windows XP (KB896727)   Ver: 1
Update for Windows XP (KB898461)   Ver: 1   Installed: 10/8/2006
Update for Windows XP (KB900485)   Ver: 2   Installed: 10/8/2006
Update for Windows XP (KB908531)   Ver: 2   Installed: 10/8/2006
Update for Windows XP (KB910437)   Ver: 1   Installed: 10/7/2006
Update for Windows XP (KB911280)   Ver: 2   Installed: 10/8/2006
Update for Windows XP (KB916595)   Ver: 1   Installed: 10/8/2006
Update for Windows XP (KB920872)   Ver: 1   Installed: 10/8/2006
Update for Windows XP (KB922582)   Ver: 1   Installed: 10/8/2006
Viewpoint Media Player   
WebFldrs XP   Ver: 9.50.7523   Installed: 8/26/2004
Windows Backup Utility   Ver: 5.1   Installed: 8/26/2004
Windows Installer 3.1 (KB893803)   Ver: 3.1
Windows Installer 3.1 (KB893803)   Ver: 3.1
Windows Media Format Runtime   
Windows Media Player 10   
Windows XP Hotfix - KB834707   Ver: 20040929.110854
Windows XP Hotfix - KB867282   Ver: 20050127.090417
Windows XP Hotfix - KB873333   Ver: 20050114.005213
Windows XP Hotfix - KB873339   Ver: 20041117.092459
Windows XP Hotfix - KB885250   Ver: 20050118.202711
Windows XP Hotfix - KB885835   Ver: 20041027.181713
Windows XP Hotfix - KB885836   Ver: 20041028.173203
Windows XP Hotfix - KB886185   Ver: 20041021.090540
Windows XP Hotfix - KB887472   Ver: 20041014.162858
Windows XP Hotfix - KB888113   Ver: 20041116.131036
Windows XP Hotfix - KB888239   Ver: 20041124.162528
Windows XP Hotfix - KB888302   Ver: 20041207.111426
Windows XP Hotfix - KB890047   Ver: 20041221.124506
Windows XP Hotfix - KB890175   Ver: 20041201.233338
Windows XP Hotfix - KB890859   Ver: 1
Windows XP Hotfix - KB890923   Ver: 1
Windows XP Hotfix - KB891781   Ver: 20050110.165439
Windows XP Hotfix - KB893066   Ver: 1
Windows XP Hotfix - KB893086   Ver: 1
WinPcap 3.1      Installed: 10/13/2006
Xfire (remove only)   
Yahoo! Install Manager

9

Tech Clinic / virus?

« on: January 10, 2007, 01:31:24 PM »

VundoFix V6.2.13

Checking Java version...

Java version is 1.5.0.2

Scan started at 10:12:03 AM 1/10/2007

Listing files found while scanning....

C:\WINDOWS\system32\vtstt.dll
C:\WINDOWS\system32\ttstv.ini
C:\WINDOWS\system32\ttstv.bak1
C:\WINDOWS\system32\ttstv.bak2
C:\WINDOWS\system32\ttstv.ini2
C:\WINDOWS\system32\ttstv.tmp
C:\WINDOWS\system32\vtstt.dll
C:\WINDOWS\system32\ttstv.ini
C:\WINDOWS\system32\ttstv.bak1
C:\WINDOWS\system32\ttstv.bak2
C:\WINDOWS\system32\ttstv.ini2
C:\WINDOWS\system32\ttstv.tmp
C:\WINDOWS\system32\ttstv.ini
C:\WINDOWS\system32\ttstv.bak1
C:\WINDOWS\system32\ttstv.bak2
C:\WINDOWS\system32\ttstv.ini2
C:\WINDOWS\system32\ttstv.tmp

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\vtstt.dll
C:\WINDOWS\system32\vtstt.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ttstv.ini
C:\WINDOWS\system32\ttstv.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ttstv.bak1
C:\WINDOWS\system32\ttstv.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ttstv.bak2
C:\WINDOWS\system32\ttstv.bak2 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ttstv.ini2
C:\WINDOWS\system32\ttstv.ini2 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ttstv.tmp
C:\WINDOWS\system32\ttstv.tmp Has been deleted!

Performing Repairs to the registry.
Done!

10

Tech Clinic / virus?

« on: January 10, 2007, 01:28:23 PM »

Logfile of HijackThis v1.99.1
Scan saved at 10:27:14 AM, on 1/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\BigFix\bigfix.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HJT\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: (no name) - {97D364E2-614A-4160-8127-CDE889EDA420} - C:\WINDOWS\system32\vtstt.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
O4 - HKCU\..\Run: [Mercora] "C:\Program Files\Mercora\MercoraClient.exe" -min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Torrent Finder] "C:\Program Files\Torrent Finder\Torrent-Finder.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

11

Tech Clinic / virus?

« on: January 09, 2007, 02:09:35 PM »

Owner - 07-01-09 11:03:53.98    Service Pack 2
ComboFix 06.11.27 - Running from: "D:\"

(((((((((((((((((((((((((((((((   Files Created from 2006-12-09 to 2007-01-09  ))))))))))))))))))))))))))))))))))
 
 
2007-01-08   18:11   81,684   --a------   C:\WINDOWS\system32\dvkenghk.dll
2007-01-08   16:54   81,684   --a------   C:\WINDOWS\system32\chheengb.dll
2007-01-05   12:33   81,684   --a------   C:\WINDOWS\system32\iovbdqgx.dll
2007-01-04   20:32   870,954   ---hs----   C:\WINDOWS\system32\ttstv.ini2
2007-01-04   12:24   81,684   --a------   C:\WINDOWS\system32\vuvdkeaq.dll
2007-01-01   19:22   <DIR>   d--------   C:\HJT
2006-12-30   19:50   <DIR>   d--------   C:\Program Files\_ArcadeDownloadFolder
2006-12-29   19:10   <DIR>   d--------   C:\My Backup -- 06-12-29 0810PM
2006-12-29   10:40   81,684   --a------   C:\WINDOWS\system32\akjkuenm.dll
2006-12-28   10:05   44,060   --a------   C:\WINDOWS\system32\msbhmfow.dll
2006-12-28   10:04   81,684   --a------   C:\WINDOWS\system32\fcjbighr.dll
2006-12-27   17:25   44,060   --a------   C:\WINDOWS\system32\jqbargpy.dll
2006-12-27   16:21   44,060   --a------   C:\WINDOWS\system32\auwnjdkh.dll
2006-12-27   15:15   44,060   --a------   C:\WINDOWS\system32\lxfdvhnu.dll
2006-12-27   14:48   44,060   --a------   C:\WINDOWS\system32\pleqjput.dll
2006-12-25   06:41   61,440   --a------   C:\WINDOWS\system32\brrotate.dll
2006-12-22   22:45   81,684   --a------   C:\WINDOWS\system32\bkxdihgx.dll
2006-12-19   16:37   81,684   --a------   C:\WINDOWS\system32\nmypsyfy.dll
2006-12-15   18:13   <DIR>   d--------   C:\Program Files\Blubster
2006-12-14   16:27   118,804   --a------   C:\WINDOWS\system32\lonxighk.dll
2006-12-14   15:02   118,804   --a------   C:\WINDOWS\system32\ntfhowex.dll


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-09 10:59   382   --a------   C:\Documents and Settings\Owner\Application Data\internaldb1942.dat
2007-01-09 10:21   --------   d--------   C:\Program Files\Mozilla Firefox
2007-01-09 10:13   69632   --a------   C:\Documents and Settings\Owner\Application Data\internaldb4827.dat
2007-01-09 10:13   151   --a------   C:\Documents and Settings\Owner\Application Data\internaldb9912.dat
2007-01-09 10:13   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb715.dat
2007-01-09 10:08   850096   ---hs----   C:\WINDOWS\system32\ttstv.bak2
2007-01-09 07:05   --------   d--------   C:\Program Files\Common Files\Symantec Shared
2007-01-08 08:30   --------   d--------   C:\Program Files\BitComet
2007-01-05 03:17   1594382   ---hs----   C:\WINDOWS\system32\ttstv.bak1
2007-01-03 08:36   --------   d--------   C:\Program Files\LimeWire
2006-12-31 18:52   --------   d--------   C:\Program Files\Google
2006-12-31 15:54   --------   d--------   C:\Program Files\Common Files\Adobe
2006-12-31 15:54   --------   d--------   C:\Program Files\Adobe
2006-12-30 19:50   --------   d--------   C:\Program Files\_ArcadeDownloadFolder
2006-12-28 10:05   39751   --a------   C:\WINDOWS\system32\brrot-uninst.exe
2006-12-27 16:02   --------   d--------   C:\Program Files\VSAdd-in
2006-12-27 14:59   --------   d--------   C:\Program Files\Soulseek
2006-12-15 14:18   --------   d--------   C:\Program Files\Internet Explorer
2006-12-15 10:18   --------   d--------   C:\Program Files\Common Files\System
2006-12-15 10:13   --------   d--------   C:\Program Files\Outlook Express
2006-12-07 01:44   --------   d--------   C:\Documents and Settings\Owner\Application Data\CyberLink
2006-12-06 22:40   2362184   --a------   C:\WINDOWS\system32\wmvcore.dll
2006-11-28 09:54   --------   d--------   C:\Program Files\Pure Networks
2006-11-28 09:54   --------   d--------   C:\Program Files\Common Files
2006-11-28 09:21   --------   d--------   C:\Program Files\BitTorrent
2006-11-28 09:17   --------   d--------   C:\Documents and Settings\Owner\Application Data\BitTorrent
2006-11-28 09:11   --------   d--------   C:\Program Files\Common Files\AOL
2006-11-28 09:10   --------   d--------   C:\Documents and Settings\Owner\Application Data\AOL
2006-11-26 20:31   --------   d--------   C:\Documents and Settings\Owner\Application Data\Adobe
2006-11-25 19:01   --------   d--------   C:\Documents and Settings\Owner\Application Data\Creative
2006-11-24 08:14   --------   d--------   C:\Program Files\Creative
2006-11-24 08:12   --------   d--h-----   C:\Program Files\InstallShield Installation Information
2006-11-24 08:05   --------   d--------   C:\Program Files\Windows Media Player
2006-11-22 18:03   --------   d--------   C:\Documents and Settings\Owner\Application Data\vlc
2006-11-20 20:37   --------   d--------   C:\Program Files\Common Files\Vbox
2006-11-20 20:23   --------   d--------   C:\Documents and Settings\Owner\Application Data\Leadertech
2006-11-20 20:05   --------   d--------   C:\Documents and Settings\Owner\Application Data\AdobeAUM
2006-11-19 19:37   --------   d--------   C:\Program Files\VideoLAN
2006-11-18 13:26   --------   d--------   C:\Program Files\MSXML 4.0
2006-11-17 18:34   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb5436.dat
2006-11-17 15:34   --------   d---s----   C:\Documents and Settings\Owner\Application Data\Microsoft
2006-11-15 15:54   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb4179.dat
2006-11-15 15:54   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb2391.dat
2006-11-15 15:54   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb1869.dat
2006-11-12 00:52   692276   ---hs----   C:\WINDOWS\system32\vtstt.dll
2006-11-12 00:46   40973   ---hs----   C:\WINDOWS\system32\vtuspop.dll
2006-11-12 00:32   9216   --a------   C:\Documents and Settings\Owner\Application Data\internaldb8467.dat
2006-11-12 00:32   49   --a------   C:\Documents and Settings\Owner\Application Data\internaldb41.dat
2006-11-12 00:32   0   --a------   C:\Documents and Settings\Owner\Application Data\internaldb6334.dat
2006-11-12 00:31   97455   --a------   C:\WINDOWS\5-a0c18a429b8010fee34ee31d9073371d.exe
2006-11-12 00:31   622613   --a------   C:\WINDOWS\4-efb7bab6499fc415ee93f4097033deae.exe
2006-11-12 00:31   365132   --a------   C:\WINDOWS\7-7c15eb3352bcc3049d7e9e974ad283bf.exe
2006-11-12 00:31   23   --a------   C:\Documents and Settings\Owner\Application Data\inifile41.ini
2006-11-12 00:03   --------   d--------   C:\Program Files\Corel
2006-11-09 18:45   --------   d--------   C:\Documents and Settings\Owner\Application Data\AdobeUM
2006-11-07 21:06   679424   --a------   C:\WINDOWS\system32\inetcomm.dll
2006-11-04 14:14   1245696   --a------   C:\WINDOWS\system32\msxml4.dll
2006-10-19 20:09   0   --a------   C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2006-10-19 05:56   713216   --a------   C:\WINDOWS\system32\sxs.dll
2006-10-13 21:26   284672   --a------   C:\WINDOWS\rapidui.exe
2006-10-13 04:35   142336   --a------   C:\WINDOWS\system32\nwprovau.dll
 
 
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Mercora"="\"C:\\Program Files\\Mercora\\MercoraClient.exe\" -min"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Torrent Finder"="\"C:\\Program Files\\Torrent Finder\\Torrent-Finder.exe\""
"updateMgr"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1"
"Creative Detector"="\"C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe\" /R"
"BitTorrent"="\"C:\\Program Files\\BitTorrent\\bittorrent.exe\" --force_start_minimized"
"Power2GoExpress"=""
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.2480\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"SoundMan"="SOUNDMAN.EXE"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"Recguard"=hex(2):25,57,49,4e,44,49,52,25,5c,53,4d,49,4e,53,54,5c,52,45,43,47,\
  55,41,52,44,2e,45,58,45,00
"Reminder"=hex(2):25,57,49,4e,44,49,52,25,5c,43,72,65,61,74,6f,72,5c,52,65,6d,\
  69,6e,64,5f,58,50,2e,65,78,65,00
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="C:\\PROGRA~1\\mcafee.com\\agent\\McUpdate.exe"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
"VirusScan Online"="c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"osCheck"="\"C:\\Program Files\\Norton AntiVirus\\osCheck.exe\""
"D-Link AirPlus XtremeG"="C:\\Program Files\\D-Link\\AirPlus XtremeG\\AirPlusCFG.exe"
"ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"AGEIA PhysX SysTray"="\"C:\\Program Files\\AGEIA Technologies\\TrayIcon.exe\""
"DllRunning"="rundll32.exe \"C:\\WINDOWS\\system32\\lonxighk.dll\",setvm"
"adstart"="C:\\WINDOWS\\System32\\Rundll32.exe \"C:\\WINDOWS\\system32\\brrotate.dll\" DllVerify"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"Source"="file:///C:/DOCUME~1/Owner/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg"
"SubscribedURL"="file:///C:/DOCUME~1/Owner/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,04,01,00,00,86,00,00,00,40,02,00,00,00,03,00,00,e8,\
  03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,04,01,00,00,86,00,00,00,40,02,00,00,00,03,\
  00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,91,04,a8,9a,83,7c,40,9a,80,7c,ff,ff,ff,ff,36,9a,\
  80,7c,36,9a,80,7c

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="http://x.myspace.com/images/LogoDotcom.gif"
"SubscribedURL"="http://x.myspace.com/images/LogoDotcom.gif"
"FriendlyName"=""
"Flags"=dword:00001001
"Position"=hex:2c,00,00,00,70,01,00,00,de,00,00,00,cd,00,00,00,2b,00,00,00,8e,\
  13,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,e1,01,00,00,84,00,00,00,cd,00,00,00,2b,00,\
  00,00,01,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,70,01,00,00,de,00,00,00,cd,00,00,00,2b,00,\
  00,00,01,00,00,40

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
  00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00,\
  00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Power2GoExpress"="NA"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Power2GoExpress"="NA"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtstt
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winetn32

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]   
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

 
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Owner.job

Completion time: 07-01-09 11:08:20.46
C:\ComboFix.txt ... 07-01-09 11:08

12

Tech Clinic / virus?

« on: January 09, 2007, 02:02:46 PM »

Logfile of HijackThis v1.99.1
Scan saved at 11:00:56 AM, on 1/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
C:\WINDOWS\system32\RUNDLL32.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\BigFix\bigfix.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: BannerCpm.com Browser Optimizer - {49C96360-9DA5-4E3A-8FF4-FAD8E79DABF2} - C:\WINDOWS\system32\brrotate.dll
O2 - BHO: (no name) - {5D3D3E35-2DFE-4D59-B6B2-24B09969F3D1} - C:\WINDOWS\system32\vtstt.dll
O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - C:\WINDOWS\system32\SearchEnhancer\nsa296.dll
O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-436325722327} - C:\WINDOWS\system32\SmartShopper\SmartShopper.dll (file missing)
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\system32\msbhmfow.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\lonxighk.dll",setvm
O4 - HKLM\..\Run: [adstart] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\brrotate.dll" DllVerify
O4 - HKCU\..\Run: [Mercora] "C:\Program Files\Mercora\MercoraClient.exe" -min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Torrent Finder] "C:\Program Files\Torrent Finder\Torrent-Finder.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O20 - Winlogon Notify: vtstt - C:\WINDOWS\system32\vtstt.dll
O20 - Winlogon Notify: winetn32 - winetn32.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

13

Tech Clinic / virus?

« on: January 08, 2007, 11:15:37 AM »

after i clicked on save list, the box closed. it's not giving me an option where to save it to.

14

Tech Clinic / virus?

« on: January 01, 2007, 10:46:31 PM »

im getting a lot of pop ups. sometimes the computer wont load all the way or all of my icons and windows will dissapear.
 
 Logfile of HijackThis v1.99.1
 Scan saved at 7:32:14 PM, on 1/1/2007
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
 C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
 C:\WINDOWS\system32\spoolsv.exe
 C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
 C:\WINDOWS\system32\CTsvcCDA.exe
 c:\program files\mcafee.com\agent\mcdetect.exe
 c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
 C:\WINDOWS\system32\nvsvc32.exe
 C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
 C:\Program Files\iPod\bin\iPodService.exe
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
 C:\WINDOWS\SOUNDMAN.EXE
 C:\WINDOWS\system32\RUNDLL32.EXE
 C:\Program Files\McAfee.com\VSO\oasclnt.exe
 C:\PROGRA~1\mcafee.com\agent\mcagent.exe
 C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
 C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
 C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
 C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
 c:\progra~1\mcafee.com\vso\mcvsescn.exe
 C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
 C:\Program Files\QuickTime\qttask.exe
 C:\Program Files\iTunes\iTunesHelper.exe
 C:\Program Files\AGEIA Technologies\TrayIcon.exe
 C:\WINDOWS\System32\Rundll32.exe
 C:\Program Files\Messenger\msmsgs.exe
 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
 C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe
 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
 C:\Program Files\Internet Explorer\iexplore.exe
 C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
 c:\progra~1\mcafee.com\vso\mcvsftsn.exe
 C:\Program Files\BigFix\bigfix.exe
 C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
 C:\WINDOWS\explorer.exe
 C:\HJT\HijackThis.exe
 
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...DTP&M=D3123
 O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
 O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
 O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
 O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
 O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
 O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
 O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
 O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
 O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
 O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
 O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
 O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
 O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
 O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
 O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
 O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
 O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
 O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe
 O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
 O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
 O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\lonxighk.dll",setvm
 O4 - HKLM\..\Run: [adstart] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\brrotate.dll" DllVerify
 O4 - HKCU\..\Run: [Mercora] "C:\Program Files\Mercora\MercoraClient.exe" -min
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [Torrent Finder] "C:\Program Files\Torrent Finder\Torrent-Finder.exe"
 O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
 O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
 O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
 O4 - HKCU\..\Run: [Power2GoExpress] "C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe" /Startup
 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.2480\GoogleToolbarNotifier.exe
 O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
 O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
 O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
 O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
 O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
 O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
 O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
 O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
 O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
 O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
 O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
 O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
 O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
 O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
 O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
 O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
 O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
 O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
 O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
 O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
 O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
 O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe