Im getting a virus alert and Spyfalcon alert in my toolbar!!!

Question

cbbcisace 0 Newbie Poster

18 Years Ago

here is a HJT Log is there anything to worry about
Logfile of HijackThis v1.99.1
Scan saved at 12:36:12, on 28/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\BTBROA~2\SMARTB~1\BTHelpNotifier.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\BT Broadband Help\bin\mpbtn.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\dcomcfg.exe
C:\WINDOWS\system32\atmclk.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SpyFalcon\spyfalcon.exe
C:\Program Files\SpyFalcon\spyfalcon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJack This\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hp25E1.tmp
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTBROA~2\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /Minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband Help\bin\matcli.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125479620453
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

windows-virus

3 Contributors
5 Replies
209 Views
1 Day Discussion Span
Latest Post 18 Years Ago Latest Post by 'Stein

tayspen 28 <Insert title here>

18 Years Ago

Lets first start with SmitRem. Download SmitRem (http://noahdfear.geekstogo.com/click...click.php?id=1).

Download smitRem.exe, saving the file to your desktop. Double click it to extract the contents to a folder of it’s own. Restart your computer in safe mode, logon to the user account that is infected, open the smitRem folder and double click the RunThis.bat file to start the tool. Follow the prompts on screen and allow disk cleanup to complete. Upon reboot, you can reset your desktop background.

Get into safe mode by pressing F8 on startup, then selecting safe mode...

---------------------------------------------------------------

When that is odne download ewido (www.ewido.net). Install. Update. Run. Remove what it finds. (Save log).

Post a new HJT log, the ewido log, and the contents of C:
SmitFiles.txt

'Stein 150 Lapsed Skeptic

18 Years Ago

Hmm, it's still there.

Let's try doin this:

Begin by downloading
SmitfraudFix. Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.
______________________________

Next, download CCleaner, specifically choosing the most recent version.

Then, follow these steps:

1. Close all programs so that you are at your desktop.
2. Double-click on the "My Computer" icon.
3. Select the "Tools" menu and click "Folder Options".
4. After the new window appears select the "View" tab.
5. Place a checkmark in the checkbox labeled "Display the contents of system folders".
6. Under the "Hidden files and folders" section select the radio button labeled "Show hidden files and folders".
7. Remove the checkmark from the checkbox labeled "Hide file extensions for known file types".
8. Remove the checkmark from the checkbox labeled "Hide protected operating system files". 9. Press the "Apply" button and then the "OK" button and shutdown My Computer.
10. Now your computer is configured to show all hidden files.

Now, install the program. Open it, and choose the 'Options' tab. Inside, hit the 'Custom' tab, and add the following folders (Note: Not all of these files are on every computer. If one of these isn't present, skip it):

C:\Windows\Temp
C:\Temp
C:\Documents and Settings\<Every user listed>\Local Settings\Temp
C:\Documents and Settings\<Every user listed>\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\<Every user listed>\History
C:\Documents and Settings\<Every user listed>\Cookies
C:\Windows\Prefetch

After doing this, move back to the 'Cleaner' tab, and inside this, be sure your open to the 'Windows' tab. Inside, check the box labeled 'Custom Files and Folders'.

Close the program.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer, so it will take some time to run. When done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive. Please post that log along with all others requested in your next reply.

IMPORTANT: Do NOT run any other options until you are asked to do so!

Post # 2 - Clean

Please print out or copy/paste these instructions to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all of the steps in the exact order in which they are listed below. If there's anything that you don't understand, ask before moving on.

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?". Type Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

If your computer does not restart automatically, do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt, located at C:\rapport.txt. Please post that log along with all others requested in your next reply.
______________________________

Now, run CCleaner, scanning only under the 'Cleaner' tab. You might need to run it several times to remove all the junk.
After running it, be sure to empty the Recycle bin.
______________________________

Close ALL open Windows / Programs / Folders. Please start Ewido, and run a full scan.

Click on Scanner
Click on Settings
- Under How to scan all boxes should be checked
- Under Unwanted Software all boxes should be checked
- Under What to scan select Scan every file
- Click on Ok
Click on Complete System Scan to start the scan process.
Let the program scan the machine.

If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says Perform action on all infections and put a checkmark in the box next to Create encrypted backup, then choose clean and click Ok.

Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.

Click Save Report button
Save the report to your Desktop

Close Ewido and Reboot in Normal Mode.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter.
Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install them. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
______________________________

In the return post, include the contents of C:\rapport.txt, the Ewido scan log, and a new HJT log.

Thanks.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

cbbcisace 0 Newbie Poster · Answer 1 · 2006-04-28T22:15:39+00:00

here are the things that you want:

HJT Log
Logfile of HijackThis v1.99.1
Scan saved at 17:13:51, on 28/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\dcomcfg.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\BTBROA~2\SMARTB~1\BTHelpNotifier.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\BT Broadband Help\bin\mpbtn.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\HiJack This\HijackThis.exe


O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hpF8A8.tmp
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTBROA~2\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /Minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband Help\bin\matcli.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125479620453
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------


+ Created on:           17:13:19, 28/04/2006
+ Report-Checksum:      7A7FF61A


+ Scan result:


:mozilla.23:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.81:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.115:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup
:mozilla.124:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.132:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.139:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.141:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.142:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.143:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.144:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.145:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.146:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.147:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.148:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adviva : Cleaned with backup
:mozilla.163:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.164:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.174:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned with backup
:mozilla.176:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned with backup
:mozilla.179:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned with backup
:mozilla.197:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.198:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.199:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.200:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.201:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.202:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.216:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.217:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.220:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.256:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.257:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.258:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.259:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.260:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.261:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.262:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.268:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.269:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.270:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.271:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.272:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.273:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.274:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.275:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.276:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.277:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.278:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.300:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned with backup
:mozilla.322:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.328:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.329:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.330:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.331:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.332:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.362:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.363:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.365:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.366:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.367:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.368:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.379:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup
:mozilla.383:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.384:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.392:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.405:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.406:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.407:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup
:mozilla.408:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup
:mozilla.409:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup
:mozilla.410:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned with backup
:mozilla.414:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.415:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.416:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.417:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.418:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.419:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.422:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.424:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.433:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.434:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.435:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.436:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.437:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.438:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.439:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.440:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.441:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.450:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.451:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.460:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.461:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.462:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.463:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.464:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.465:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.466:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.478:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.479:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.480:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.489:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.490:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.494:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.513:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.514:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.520:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.553:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.554:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.561:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.562:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.565:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
:mozilla.576:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.577:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned with backup
:mozilla.583:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned with backup
:mozilla.588:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.589:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.590:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.591:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.592:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.593:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.598:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.599:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.602:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.603:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.604:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.605:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.610:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.624:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.635:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.647:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.649:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.650:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.651:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.652:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.670:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.671:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.704:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.707:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.711:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.714:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.715:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.720:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.739:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.771:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.790:C:\Documents and Settings\Paula\Application Data\Mozilla\Firefox\Profiles\eid2tcp4.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
C:\Program Files\backups\backup-20060305-151608-990.dll -> Downloader.Delf.agw : Cleaned with backup
C:\Program Files\Common Files\uqqf\uqqfd\uqqfc.dll -> Adware.TargetServer : Cleaned with backup
C:\Program Files\Mozilla Firefox\plugins\npclntax.dll -> Adware.Zango : Cleaned with backup
C:\Program Files\SpyFalcon -> Adware.SpyFalcon : Cleaned with backup
C:\Program Files\SpyFalcon\ignored.lst -> Adware.SpyFalcon : Cleaned with backup
C:\Program Files\SpyFalcon\sf.ini -> Adware.SpyFalcon : Cleaned with backup
C:\Program Files\SpyFalcon\SpyFalcon.exe -> Adware.SpyFalcon : Cleaned with backup
C:\WINDOWS\system32\admparsel.dll -> Downloader.Delf.agw : Cleaned with backup
C:\WINDOWS\system32\__delete_on_reboot__twain32.dll -> Not-A-Virus.Hoax.Win32.Renos.cu : Cleaned with backup



::Report End



smitRem © log file
version 2.8


by noahdfear



Microsoft Windows XP [Version 5.1.2600]
The current date is: 28/04/2006
The current time is: 15:47:24.95


Running from
C:\Smit Rem\smitRem


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Pre-run SharedTask Export


(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com


Registry Pseudo-Format Mode (Not a valid reg file):


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{B212D577-05B7-4963-911E-4A8588160DFA}"="st3i"
"{16875E09-927B-4494-82BD-158A1CD46BA0}"="z"
"{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}"="Master Browseui"
"{CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E}"="Twain"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"



[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"



[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E}\InProcServer32]
@="C:\WINDOWS\system32\twain32.dll"



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


checking for ShudderLTD key


ShudderLTD key not present!


checking for PSGuard.com key


PSGuard.com key not present!



checking for WinHound.com key


WinHound.com key not present!


spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Existing Pre-run Files



~~~ Program Files ~~~


~~~ Shortcuts ~~~


Online Security Guide.url
Security Troubleshooting.url



~~~ Favorites ~~~


Antivirus Test Online.url



~~~ system32 folder ~~~


1024 dir
ld****.tmp
ncompat.tlb
hp***.tmp



~~~ Icons in System32 ~~~


ts.ico
ot.ico



~~~ Windows directory ~~~


secure32.html



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 832 'explorer.exe'
Killing PID 832 'explorer.exe'


Starting registry repairs


Registry repairs complete


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


SharedTask Export after registry fix


(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com


Registry Pseudo-Format Mode (Not a valid reg file):


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{B212D577-05B7-4963-911E-4A8588160DFA}"="st3i"
"{16875E09-927B-4494-82BD-158A1CD46BA0}"="z"
"{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}"="Master Browseui"
"{CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E}"="Twain"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"



[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"



[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E}\InProcServer32]
@="C:\WINDOWS\system32\twain32.dll"



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Deleting files


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Remaining Post-run Files



~~~ Program Files ~~~


~~~ Shortcuts ~~~


~~~ Favorites ~~~


~~~ system32 folder ~~~


~~~ Icons in System32 ~~~


~~~ Windows directory ~~~


~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~



~~~ Wininet.dll ~~~

CLEAN! :)

cbbcisace 0 Newbie Poster · Answer 2 · 2006-04-29T16:48:26+00:00

here are the things you wanted

SmitFraudFix v2.37


Scan done at 10:03:31.15, 29/04/2006
Run from C:\Documents and Settings\Paula\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]


»»»»»»»»»»»»»»»»»»»»»»»» Killing process



»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


C:\WINDOWS\tool3.exe Deleted
C:\WINDOWS\system32\atmclk.exe Deleted
C:\WINDOWS\system32\dcomcfg.exe Deleted
C:\WINDOWS\system32\hp????.tmp Deleted
C:\WINDOWS\system32\simpole.tlb Deleted
C:\WINDOWS\system32\stdole3.tlb Deleted
C:\Program Files\MalwareWipe\ Deleted


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files



»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning


Registry Cleaning done.


»»»»»»»»»»»»»»»»»»»»»»»» End


Logfile of HijackThis v1.99.1
Scan saved at 11:46:50, on 29/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\BTBROA~2\SMARTB~1\BTHelpNotifier.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\BT Broadband Help\bin\mpbtn.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HiJack This\HijackThis.exe


O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTBROA~2\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /Minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband Help\bin\matcli.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125479620453
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------


+ Created on:           11:36:49, 29/04/2006
+ Report-Checksum:      1612D4FE


+ Scan result:


No infected objects found.



::Report End

'Stein 150 Lapsed Skeptic Team Colleague · Answer 3 · 2006-04-29T23:28:47+00:00

Awsome, it worked. And, the log's clean.

Follow these intructions to rehide hidden folders:

We need to re hide system files. To do so, please follow the steps below:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Put a check by "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

Lastly, are ya still having problems?

Thanks.