Spyware/Adware Infection Precaution Advisory

• ndmmxiaomayi

  27 Jul 07, 14:17

  What scanner is that?
• alvin-ncs

  27 Jul 07, 16:37

  Originally posted by ndmmxiaomayi:

  This one? I congratulate you. This one wrecks havoc. If your PC is stable enough, backup and prepare for format.

  quite stable...
  
  now i clear alot of things lao...
  
  then okok...
  
  still need?
  
  it didnt pop out now...
• ndmmxiaomayi

  27 Jul 07, 20:41

  Originally posted by alvin-ncs:

  quite stable...
  
  now i clear alot of things lao...
  
  then okok...
  
  still need?
  
  it didnt pop out now...

  Can you double check if ALL of your programs are working properly?
• alvin-ncs

  28 Jul 07, 23:06

  Originally posted by ndmmxiaomayi:

  Can you double check if ALL of your programs are working properly?

  hmmmm....somehow working perfectly...test every programme in my com and it seems fine....
• alvin-ncs

  28 Jul 07, 23:12

  but somehow my com seems slower than be4 after i chear the virus and install new and delete my firewall and anti spyware...
• ndmmxiaomayi

  29 Jul 07, 00:06

  Originally posted by alvin-ncs:

  but somehow my com seems slower than be4 after i chear the virus and install new and delete my firewall and anti spyware...

  After virus attack it's like that.
  
  I would recommend to get them back...
• alvin-ncs

  29 Jul 07, 11:07

  Originally posted by ndmmxiaomayi:

  After virus attack it's like that.
  
  I would recommend to get them back...

  now i am using avg anti virus and avg anti spyware and cleaner...
  
  be4 that i am using zonealarm, avg anti virus and S&D...
  
  now i feel better without zonealarm...
  as zonealarm dont alow many of my programme to run....
• ndmmxiaomayi

  29 Jul 07, 15:55

  Originally posted by alvin-ncs:

  now i am using avg anti virus and avg anti spyware and cleaner...
  
  be4 that i am using zonealarm, avg anti virus and S&D...
  
  now i feel better without zonealarm...
  as zonealarm dont alow many of my programme to run....

  ZoneAlarm is a resource hog. Comodo, which is popular right now and is light on resources, is preferred by a lot of people.
• alvin-ncs

  29 Jul 07, 23:50

  Originally posted by ndmmxiaomayi:

  ZoneAlarm is a resource hog. Comodo, which is popular right now and is light on resources, is preferred by a lot of people.

  but it make me laggy, slows my com down and block alot of programme...
  
  anyway to prevent that?
• ndmmxiaomayi

  30 Jul 07, 02:19

  Originally posted by alvin-ncs:

  but it make me laggy, slows my com down and block alot of programme...
  
  anyway to prevent that?

  That's a firewall job. If it doesn't block, then how it protects? Just set it to allow, and when it prompts, tell it to remember the setting so it doesn't prompt you again.
• alvin-ncs

  30 Jul 07, 19:39

  Originally posted by ndmmxiaomayi:

  That's a firewall job. If it doesn't block, then how it protects? Just set it to allow, and when it prompts, tell it to remember the setting so it doesn't prompt you again.

  i tried to allow the programme i always use...
  
  but cannot get through...
  
  so i angry and delete and replace it...
  
  LOL...
• relgn

  4 Aug 07, 10:13

  Logfile of HijackThis v1.99.1
  Scan saved at 10:12:51, on 04/08/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Norton Personal Firewall\NISUM.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\Program Files\defwatch.exe
  C:\Program Files\rtvscan.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  C:\WINDOWS\system32\MsgSys.EXE
  C:\windows\system\hpsysdrv.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\System32\hphmon05.exe
  C:\WINDOWS\system32\ps2.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\ALCXMNTR.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
  C:\PROGRA~1\vptray.exe
  C:\Program Files\SmartFix\bin\McciTrayApp.exe
  C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Documents and Settings\Owner\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qsg10.hpwis.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mysingtel.com.sg
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by mysingtel
  O1 - Hosts: 64.233.167.104 sandbox.norman.no
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
  O3 - Toolbar: (no name) - {5AA06644-BC46-4220-A460-47A6EB47C96D} - (no file)
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
  O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
  O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
  O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [websx] C:\Program Files\websx\int113777.exe -auto
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
  O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\vptray.exe
  O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [Stupid Data Dart Wave] C:\Documents and Settings\All Users\Application Data\flag ace stupid data\mode info.exe
  O4 - HKLM\..\Run: [seek obj fast wave] C:\Documents and Settings\All Users\Application Data\Two Idol Wave Flag\Live software find.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [hopevga] C:\DOCUME~1\Owner\APPLIC~1\BONEBR~1\Wipe Anti Play.exe
  O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://www.mysingtel.com.sg
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\defwatch.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\NISUM.EXE
  O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\rtvscan.exe
  O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
• ndmmxiaomayi

  4 Aug 07, 11:48

  Hello relgn,
  
  Did you purposely set this?
  
  

  O1 - Hosts: 64.233.167.104 sandbox.norman.no

  The IP address belongs to Google, not Norman.
  
  Please remove Messenger Plus! 3 if you have it installed by going to Start > Control Panel and double clicking on Add/Remove Programs.
  
  Next, please download NoLop from one of the links given and save it to your desktop.
  
  From Spyware Edge
  From Spy Killer
  From Greyknight
  From Spyware Times
  
  

  [*]First close any other programs you have running as this will require a reboot.
  [*]Double click NoLop.exe to run it.
  [*]Now click the button labelled Search and Destroy
  <>
  [*]When scanning is finished you will be prompted to reboot only if infected, Click OK.
  [*]Now click the REBOOT Button.
  [*]A Message should popup from NoLop. If not, double click the program again and it will finish. Please Post the contents of C:\NoLop.log along with a fresh HijackThis log.

  If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx and save it to C:\Windows\system32 folder then rerun NoLop.
  
  Lastly, please get me an uninstall list by doing the following:
  
  

  [*]Open HijackThis.
  [*]Select Open the Misc Tools section.
  [*]Look under System tools.
  [*]Click on the Open Uninstall Manager... button.
  [*]Click on the Save list... button.
  [*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
  [*]Notepad will open. Please post this uninstall list in your next reply.

  
  
  In your next reply, please post:
  
  

  [*]NoLop log (C:\NoLop.log)
  [*]The Uninstall list
  [*]A new HijackThis log
• relgn

  4 Aug 07, 16:21

  Did you purposely set this?
  
  The IP address belongs to Google, not Norman.
  
  Ans: No
  
  1. The Uninstall list
  Adobe Atmosphere Player for Acrobat and Adobe Reader
  Adobe Flash Player 9 ActiveX
  Adobe Photoshop Album 2.0 Starter Edition
  Adobe Reader 7.0.8
  Alcatel SpeedTouch USB Software
  Apple Mobile Device Support
  Apple Software Update
  ArcSoft ShowBiz 2
  AVI Codec Pack
  AVI Codec Pack Lite
  Azureus Vuze
  Compaq Connections
  Counter-Strike 1.6
  Creative MediaSource
  CueClub
  Disc2Phone
  DivX
  DivX Player
  HijackThis 1.99.1
  Hotfix for Windows Media Format 11 SDK (KB929399)
  Hotfix for Windows XP (KB926239)
  HP Deskjet Preloaded Printer Drivers
  HP Photo & Imaging 3.1
  HP Photo and Imaging 2.0 - Photosmart Cameras
  
  2. Logfile of HijackThis v1.99.1
  Scan saved at 16:17:19, on 04/08/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Norton Personal Firewall\NISUM.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\windows\system\hpsysdrv.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\System32\hphmon05.exe
  C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
  C:\WINDOWS\system32\ps2.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\ALCXMNTR.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
  C:\PROGRA~1\vptray.exe
  C:\Program Files\SmartFix\bin\McciTrayApp.exe
  C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\Program Files\defwatch.exe
  C:\Program Files\rtvscan.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\MsgSys.EXE
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\Owner\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qsg10.hpwis.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mysingtel.com.sg
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by mysingtel
  O1 - Hosts: 64.233.167.104 sandbox.norman.no
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
  O3 - Toolbar: (no name) - {5AA06644-BC46-4220-A460-47A6EB47C96D} - (no file)
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
  O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
  O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
  O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [websx] C:\Program Files\websx\int113777.exe -auto
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
  O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\vptray.exe
  O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [Stupid Data Dart Wave] C:\Documents and Settings\All Users\Application Data\flag ace stupid data\mode info.exe
  O4 - HKLM\..\Run: [seek obj fast wave] C:\Documents and Settings\All Users\Application Data\Two Idol Wave Flag\Live software find.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe
  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [hopevga] C:\DOCUME~1\Owner\APPLIC~1\BONEBR~1\Wipe Anti Play.exe
  O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://www.mysingtel.com.sg
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\defwatch.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\NISUM.EXE
  O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\rtvscan.exe
  O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  
  3. NoLop! Log by Skate_Punk_21
  
  Fix running from: C:\Documents and Settings\Owner\Desktop
  [04/08/2007]
  [16:00:21]
  
  ---Infection Files Found/Removed---
  C:\WINDOWS\tasks\8ADDAA268B2A231E.job
  
  Beginning Removal...
  Rebooting...
  Removing Lop's Leftover Files/Folders...
  Editing Registry...
  **Fix Complete!**
  
  ---Listing AppData sub directories---
  
  C:\Documents and Settings\All Users\Application Data\Adobe
  C:\Documents and Settings\All Users\Application Data\Apple
  C:\Documents and Settings\All Users\Application Data\Apple Computer
  C:\Documents and Settings\All Users\Application Data\Azureus
  C:\Documents and Settings\All Users\Application Data\Flag Ace Stupid Data
  C:\Documents and Settings\All Users\Application Data\Gluesixtherrorwarn -- EMPTY Directory
  C:\Documents and Settings\All Users\Application Data\Microsoft
  C:\Documents and Settings\All Users\Application Data\Motive
  C:\Documents and Settings\All Users\Application Data\Motivesysids
  C:\Documents and Settings\All Users\Application Data\Msn6
  C:\Documents and Settings\All Users\Application Data\Quicktime
  C:\Documents and Settings\All Users\Application Data\Sbsi
  C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
  C:\Documents and Settings\All Users\Application Data\Symantec
  C:\Documents and Settings\All Users\Application Data\Two Idol Wave Flag
  C:\Documents and Settings\All Users\Application Data\Viewpoint
  C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
  C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
  C:\Documents and Settings\Default User\Application Data\Identities
  C:\Documents and Settings\Default User\Application Data\Microsoft
  C:\Documents and Settings\Default User\Application Data\Real
  C:\Documents and Settings\Default User\Application Data\Sampleview -- EMPTY Directory
  C:\Documents and Settings\Default User\Application Data\Sonic
  C:\Documents and Settings\Default User\Application Data\Sun
  C:\Documents and Settings\Default User\Application Data\Symantec
  C:\Documents and Settings\Localservice\Application Data\Microsoft
  C:\Documents and Settings\Localservice\Application Data\Symantec
  C:\Documents and Settings\Networkservice\Application Data\Microsoft
  C:\Documents and Settings\Networkservice\Application Data\Symantec
  C:\Documents and Settings\Owner\Application Data\.bittorrent
  C:\Documents and Settings\Owner\Application Data\Adobe
  C:\Documents and Settings\Owner\Application Data\Adobeum
  C:\Documents and Settings\Owner\Application Data\Apple Computer
  C:\Documents and Settings\Owner\Application Data\Arcsoft
  C:\Documents and Settings\Owner\Application Data\Azureus
  C:\Documents and Settings\Owner\Application Data\Bittyrant
  C:\Documents and Settings\Owner\Application Data\Bone Browse Sign
  C:\Documents and Settings\Owner\Application Data\Creative
  C:\Documents and Settings\Owner\Application Data\Dmcache -- EMPTY Directory
  C:\Documents and Settings\Owner\Application Data\Google
  C:\Documents and Settings\Owner\Application Data\Help -- EMPTY Directory
  C:\Documents and Settings\Owner\Application Data\Identities
  C:\Documents and Settings\Owner\Application Data\Intervideo
  C:\Documents and Settings\Owner\Application Data\Leadertech
  C:\Documents and Settings\Owner\Application Data\Macromedia
  C:\Documents and Settings\Owner\Application Data\Microsoft
  C:\Documents and Settings\Owner\Application Data\Motive
  C:\Documents and Settings\Owner\Application Data\Mozilla
  C:\Documents and Settings\Owner\Application Data\Msn6
  C:\Documents and Settings\Owner\Application Data\Real
  C:\Documents and Settings\Owner\Application Data\Sampleview -- EMPTY Directory
  C:\Documents and Settings\Owner\Application Data\Sonic
  C:\Documents and Settings\Owner\Application Data\Sun
  C:\Documents and Settings\Owner\Application Data\Symantec
  C:\Documents and Settings\Owner\Application Data\Talkback
  C:\Documents and Settings\Owner\Application Data\Teleca
  C:\Documents and Settings\Owner\Application Data\Template
  C:\Documents and Settings\Owner\Application Data\Vlc
  
• relgn

  4 Aug 07, 16:23

  Can my computer survive?? Required any further action?
  
  Thanks xiaomayi
• ndmmxiaomayi

  4 Aug 07, 23:58

  Originally posted by relgn:

  Can my computer survive?? Required any further action?
  
  Thanks xiaomayi

  Can survive. Just need to fix the registry and delete some files. But your uninstall list is very short. You sure only these programs are installed? XP SP2 has more than this.
  
  And ar... don't say I never warn you, keep out of porn sites. Something in your log indicates you have visited porn sites.
  
  Please disable Windows Defender temporarily as it may interfere with the fix. To do so, follow the instructions below:
  
  

  [*]Go to Start > All Programs > Windows Defender.
  [*]Click on Tools at the top.
  [*]Under Settings, click on Options.
  [*]Under Automatic scanning, uncheck (untick) Automatically scan my computer (recommended) box.
  [*]Under Real-time protection options, uncheck (untick) Use real-time protection (recommended) box.
  [*]Click on the Save button at the bottom right hand corner.

  
  
  Open HijackThis and select Do a system scan only.
  
  Put a tick next to these lines:
  
  O1 - Hosts: 64.233.167.104 sandbox.norman.no
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
  O3 - Toolbar: (no name) - {5AA06644-BC46-4220-A460-47A6EB47C96D} - (no file)
  O4 - HKLM\..\Run: [websx] C:\Program Files\websx\int113777.exe -auto
  O4 - HKLM\..\Run: [Stupid Data Dart Wave] C:\Documents and Settings\All Users\Application Data\flag ace stupid data\mode info.exe
  O4 - HKLM\..\Run: [seek obj fast wave] C:\Documents and Settings\All Users\Application Data\Two Idol Wave Flag\Live software find.exe
  
  Click Fix checked.
  ___________________
  
  Show hidden files and folders
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Uncheck (untick) Hide extensions of known file types.
  [*]Uncheck (untick) Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  ___________________
  
  

  [*]Please download AVG Anti-Spyware and save it to your desktop.
  [*]Double click on avgas-setup-7.5.0.50.exe to install AVG Anti-Spyware. Install it in the default location.
  [*]Once installed, start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
  [*]In the main screen, you should see Your Computer's Security.
  [*]Next to Resident Shield, click on Change state. It should now be Inactive.
  [*]Next to Automatic Updates, click on Change state. It should now be Inactive.
  [*]Next to Last Update, click on Update now. If your firewall prompts you, tell your firewall to allow it. Should you be unable to update it, download the updates from here. Save it to your desktop. Double click to run the installation and the updates will be installed. Make sure AVG Anti-Spyware is closed during the installation.
  [*]Right-click the AVG Anti-Spyware icon near the clock and uncheck (untick) Start with Windows. Confirm by clicking Yes.
  [*]Now click on the Scanner button at the top.
  [*]Select the Settings tab.
  [*]Under How to act?, click on Recommended actions and select Quarantine.
  [*]Under How to scan?, check (tick) all the boxes.
  [*]Under Possibly unwanted software:, check (tick) all the boxes.
  [*]Under Reports:, uncheck (untick) the Only if threats were found box and select Do not automatically generate report.
  [*]Under What to scan?, select Scan every file.

  Do not run a scan yet. You will run a scan later.
  ___________________
  
  Please download ATF Cleaner by Atribune.
  
  

  [*]Double-click ATF-Cleaner.exe to run the program.
  [*]Under Main choose: Select All.
  [*]Click the Empty Selected button.

  
  
  If you use Firefox browser
  
  

  [*]Click Firefox at the top and choose: Select All.
  [*]Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

  
  
  If you use Opera browser
  
  

  [*]Click Opera at the top and choose: Select All.
  [*]Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

  
  ___________________
  
  Restart your computer in Safe Mode.
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.

  
  
  Delete these folders.
  
  C:\Program Files\websx
  C:\Documents and Settings\All Users\Application Data\flag ace stupid data
  C:\Documents and Settings\All Users\Application Data\Two Idol Wave Flag
  C:\Documents and Settings\Owner\Application Data\Bone Browse Sign
  ___________________
  
  

  [*]Start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
  [*]Click on the Scanner button at the top.
  [*]Select the Scan tab.
  [*]Click on Complete System Scan to start the scan.
  [*]When the scan has finished, follow the instructions below.
  IMPORTANT: Don't click on the Save Scan Report button before you did hit the Apply all Actions button.
  
  [*]Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  [*]At the bottom of the window click on the Apply all Actions button. (3)
  
  
  [*]When done, click the Save Scan Report button. (4)
  
  [*]Click the Save Report as button.
  [*]Save the report to your Desktop.
  
  [*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

  Restart your computer in Normal Mode.
  ___________________
  
  Please go to Kaspersky website and perform an online antivirus scan.
  Please use Internet Explorer as it uses ActiveX.
  
  

  [*]Click on Kaspersky Online Scanner button.
  [*]Read through the requirements and privacy statement and click on Accept button.
  [*]It will start downloading and installing the scanner and virus definitions. You will be prompted to install an ActiveX from Kaspersky. Click Yes.
  [*]When the downloads have finished, click on Next button.
  [*]Click on Scan Settings button.
  [*]Select extended under Scan using the following antivirus database:
  [*]Check (tick) these boxes under Scan options:
  [*]Scan Archives
  [*]Scan Mail Bases
  [*]Click OK
  [*]Click on My Computer under Please select a target to scan:
  [*]Once the scan is complete it will display if your system has been infected. Click on Save as text button and save it to your desktop.
  [*]Copy and paste this log in your next reply.

  
  
  In your next reply, please post:
  
  

  [*]The Uninstall List
  [*]AVG Antispyware scan report
  [*]Kaspersky Antivirus scan report
  [*]A new HijackThis log
• relgn

  5 Aug 07, 23:03

  Omg!!! your prescription like getting longer and longer.
  I think this is my longest post in my sgforum life
  ---------------------------------------------------
  1. Uninstall list
  Adobe Atmosphere Player for Acrobat and Adobe Reader
  Adobe Flash Player 9 ActiveX
  Adobe Photoshop Album 2.0 Starter Edition
  Adobe Reader 7.0.8
  Alcatel SpeedTouch USB Software
  Apple Mobile Device Support
  Apple Software Update
  ArcSoft ShowBiz 2
  AVG Anti-Spyware 7.5
  AVI Codec Pack
  AVI Codec Pack Lite
  Azureus Vuze
  Compaq Connections
  Counter-Strike 1.6
  Creative MediaSource
  CueClub
  Disc2Phone
  DivX
  DivX Player
  HijackThis 1.99.1
  Hotfix for Windows Media Format 11 SDK (KB929399)
  Hotfix for Windows XP (KB926239)
  HP Deskjet Preloaded Printer Drivers
  HP Photo & Imaging 3.1
  HP Photo and Imaging 2.0 - Photosmart Cameras
  HP PSC & OfficeJet 3.0
  HP Software Update
  Intel(R) Extreme Graphics Driver
  InterVideo WinDVD Player
  iPod for Windows 2005-03-23
  iPod for Windows 2005-09-23
  iTunes
  Java 2 Runtime Environment, SE v1.4.2
  Java(TM) SE Runtime Environment 6 Update 1
  Kaspersky Online Scanner
  LiveReg (Symantec Corporation)
  LiveUpdate 3.0 (Symantec Corporation)
  Macromedia Shockwave Player
  MediaCoder 0.6.0
  Memories Disc Creator 2.0
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft Compression Client Pack 1.0 for Windows XP
  Microsoft Data Access Components KB870669
  Microsoft Encarta Encyclopedia Standard - WE 2004
  Microsoft Money
  Microsoft Money System Pack
  Microsoft Office XP Standard
  Microsoft User-Mode Driver Framework Feature Pack 1.0
  Microsoft Windows Journal Viewer
  Microsoft Works 7.0
  MiraScan V4.02
  Mozilla Firefox (2.0.0.6)
  MSXML 4.0 SP2 (KB92797
  Norton AntiVirus Corporate Edition
  Norton Personal Firewall
  Norton WMI Update
  nProtect KeyCrypt
  PC-Doctor for Windows
  Photosmart 140,240,7200,7600,7700,7900 Series
  POD-Bot 2.0
  PS2
  Python 2.2 combined Win32 extensions
  Python 2.2.1
  QuickTime
  RealPlayer
  RecordNow!
  Security Update for CAPICOM (KB931906)
  Security Update for CAPICOM (KB931906)
  Security Update for Step By Step Interactive Training (KB89845
  Security Update for Step By Step Interactive Training (KB923723)
  Security Update for Windows Media Player (KB911564)
  Security Update for Windows Media Player 10 (KB911565)
  Security Update for Windows Media Player 10 (KB917734)
  Security Update for Windows Media Player 6.4 (KB92539
  Security Update for Windows XP (KB883939)
  Security Update for Windows XP (KB890046)
  Security Update for Windows XP (KB893756)
  Security Update for Windows XP (KB89635
  Security Update for Windows XP (KB896422)
  Security Update for Windows XP (KB896423)
  Security Update for Windows XP (KB896424)
  Security Update for Windows XP (KB89642
  Security Update for Windows XP (KB89668
  Security Update for Windows XP (KB899587)
  Security Update for Windows XP (KB89958
  Security Update for Windows XP (KB899591)
  Security Update for Windows XP (KB900725)
  Security Update for Windows XP (KB901017)
  Security Update for Windows XP (KB901190)
  Security Update for Windows XP (KB901214)
  Security Update for Windows XP (KB902400)
  Security Update for Windows XP (KB903235)
  Security Update for Windows XP (KB904706)
  Security Update for Windows XP (KB905414)
  Security Update for Windows XP (KB905749)
  Security Update for Windows XP (KB905915)
  Security Update for Windows XP (KB908519)
  Security Update for Windows XP (KB908531)
  Security Update for Windows XP (KB911280)
  Security Update for Windows XP (KB911562)
  Security Update for Windows XP (KB911567)
  Security Update for Windows XP (KB911927)
  Security Update for Windows XP (KB912812)
  Security Update for Windows XP (KB912919)
  Security Update for Windows XP (KB913446)
  Security Update for Windows XP (KB913580)
  Security Update for Windows XP (KB91438
  Security Update for Windows XP (KB914389)
  Security Update for Windows XP (KB916281)
  Security Update for Windows XP (KB917159)
  Security Update for Windows XP (KB917344)
  Security Update for Windows XP (KB917422)
  Security Update for Windows XP (KB917953)
  Security Update for Windows XP (KB91811
  Security Update for Windows XP (KB918439)
  Security Update for Windows XP (KB918899)
  Security Update for Windows XP (KB919007)
  Security Update for Windows XP (KB920213)
  Security Update for Windows XP (KB920214)
  Security Update for Windows XP (KB920670)
  Security Update for Windows XP (KB920683)
  Security Update for Windows XP (KB920685)
  Security Update for Windows XP (KB92139
  Security Update for Windows XP (KB921883)
  Security Update for Windows XP (KB922616)
  Security Update for Windows XP (KB922760)
  Security Update for Windows XP (KB922819)
  Security Update for Windows XP (KB923191)
  Security Update for Windows XP (KB923414)
  Security Update for Windows XP (KB923694)
  Security Update for Windows XP (KB923980)
  Security Update for Windows XP (KB924191)
  Security Update for Windows XP (KB924270)
  Security Update for Windows XP (KB924496)
  Security Update for Windows XP (KB924667)
  Security Update for Windows XP (KB925454)
  Security Update for Windows XP (KB925486)
  Security Update for Windows XP (KB925902)
  Security Update for Windows XP (KB926255)
  Security Update for Windows XP (KB926436)
  Security Update for Windows XP (KB927779)
  Security Update for Windows XP (KB927802)
  Security Update for Windows XP (KB928090)
  Security Update for Windows XP (KB928255)
  Security Update for Windows XP (KB928843)
  Security Update for Windows XP (KB929123)
  Security Update for Windows XP (KB929969)
  Security Update for Windows XP (KB93017
  Security Update for Windows XP (KB931261)
  Security Update for Windows XP (KB93176
  Security Update for Windows XP (KB931784)
  Security Update for Windows XP (KB93216
  Security Update for Windows XP (KB933566)
  Security Update for Windows XP (KB935839)
  Security Update for Windows XP (KB935840)
  Shockwave
  SingTel SmartFix
  Sonic Update Manager
  SpeedTouch USB
  Symantec Technical Support Web Controls
  Update for Windows XP (KB894391)
  Update for Windows XP (KB896727)
  Update for Windows XP (KB898461)
  Update for Windows XP (KB900485)
  Update for Windows XP (KB910437)
  Update for Windows XP (KB916595)
  Update for Windows XP (KB920872)
  Update for Windows XP (KB922582)
  Update for Windows XP (KB927891)
  Update for Windows XP (KB930916)
  Update for Windows XP (KB931836)
  Update for Windows XP (KB936357)
  VideoLAN VLC media player 0.8.6
  Windows Defender
  Windows Installer 3.1 (KB893803)
  Windows Installer 3.1 (KB893803)
  Windows Live Messenger
  Windows Media Format 11 runtime
  Windows Media Format 11 runtime
  Windows Media Player 11
  Windows Media Player 11
  Windows XP Hotfix - KB834707
  Windows XP Hotfix - KB867282
  Windows XP Hotfix - KB873333
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB885250
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB885884
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Windows XP Hotfix - KB887742
  Windows XP Hotfix - KB888113
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB890047
  Windows XP Hotfix - KB890175
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB890923
  Windows XP Hotfix - KB891781
  Windows XP Hotfix - KB893066
  Windows XP Hotfix - KB893086
  Windows XP Service Pack 2
  WinRAR archiver
  
  ---------------------------------------------------------
  2. AVG Anti-Spyware - Scan Report
  ---------------------------------------------------------
  
  + Created at: 13:16:51 05/08/2007
  
  + Scan result:
  
  C:\Documents and Settings\Owner\Local Settings\Temp\SHNT288.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
  :mozilla.105:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.106:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.107:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.108:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.109:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.110:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.111:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.112:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.113:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.114:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.171:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.350:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.513:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.662:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.186:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.187:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.188:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.189:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.190:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.191:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.192:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.193:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.194:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.195:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.196:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.197:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.198:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.199:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.200:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.201:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.202:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.203:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.204:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.205:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.206:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.207:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.208:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.209:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.20:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.21:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.23:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.24:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.626:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.627:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
  :mozilla.745:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
  :mozilla.746:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
  :mozilla.164:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
  :mozilla.165:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
  :mozilla.166:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
  :mozilla.167:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
  :mozilla.133:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
  :mozilla.770:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
  :mozilla.274:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
  :mozilla.771:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
  :mozilla.694:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
  :mozilla.280:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Com : Cleaned.
  :mozilla.691:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned.
  :mozilla.127:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
  :mozilla.170:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
  :mozilla.78:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
  :mozilla.79:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
  :mozilla.80:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
  :mozilla.81:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
  :mozilla.82:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
  :mozilla.748:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Information : Cleaned.
  :mozilla.749:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
  :mozilla.750:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
  :mozilla.751:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
  :mozilla.724:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
  :mozilla.163:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
  :mozilla.678:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
  :mozilla.545:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
  :mozilla.547:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned.
  :mozilla.93:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
  :mozilla.214:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
  :mozilla.215:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
  :mozilla.216:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
  :mozilla.217:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
  :mozilla.60:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Porntrack : Cleaned.
  :mozilla.566:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
  :mozilla.567:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
  :mozilla.578:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
  :mozilla.579:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
  :mozilla.580:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
  :mozilla.584:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
  :mozilla.585:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
  :mozilla.586:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
  :mozilla.587:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
  :mozilla.588:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
  :mozilla.589:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
  :mozilla.273:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.598:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.599:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.600:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.601:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.602:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.283:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.284:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.285:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.286:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.287:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.288:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.289:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.290:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.291:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.292:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
  :mozilla.49:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
  :mozilla.617:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
  :mozilla.618:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
  :mozilla.619:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
  :mozilla.620:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
  :mozilla.645:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Trafic : Cleaned.
  :mozilla.709:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
  :mozilla.92:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
  :mozilla.581:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
  :mozilla.582:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
  :mozilla.583:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
  :mozilla.727:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
  :mozilla.100:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
  :mozilla.101:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
  :mozilla.102:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
  :mozilla.98:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
  :mozilla.99:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP309\A0104747.exe -> Trojan.Obfuscated.en : Cleaned with backup (quarantined).
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP309\A0104748.exe -> Trojan.Obfuscated.en : Cleaned with backup (quarantined).
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP309\A0104749.exe -> Worm.Delf.aj : Cleaned with backup (quarantined).
  
  ::Report end
  
  -------------------------------------------------------------------------------
  3. KASPERSKY ONLINE SCANNER REPORT
  Sunday, August 05, 2007 10:53:03 PM
  Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
  Kaspersky Online Scanner version: 5.0.83.0
  Kaspersky Anti-Virus database last update: 5/08/2007
  Kaspersky Anti-Virus database records: 373093
  -------------------------------------------------------------------------------
  
  Scan Settings:
  Scan using the following antivirus database: extended
  Scan Archives: true
  Scan Mail Bases: true
  
  Scan Target - My Computer:
  A:\
  C:\
  D:\
  
  Scan Statistics:
  Total number of scanned objects: 91153
  Number of viruses found: 8
  Number of infected objects: 28 / 0
  Number of suspicious objects: 0
  Duration of the scan process: 02:21:04
  
  Infected Object Name / Virus Name / Last Action
  C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-08042007-095415.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-08-05_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EB80000.VBN Infected: Trojan.Win32.Obfuscated.en skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F980000.VBN Infected: Trojan.Win32.Obfuscated.en skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton Personal Firewall\Log\Confdntl.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton Personal Firewall\Log\Content.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton Personal Firewall\Log\Privacy.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton Personal Firewall\Log\Restrict.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton Personal Firewall\Log\Spam.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton Personal Firewall\Log\WebHist.log Object is locked skipped
  C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Azureus\ipfilter.cache Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Azureus\tmp\AZU30143.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Azureus\tmp\AZU30144.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Azureus\tmp\AZU30145.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Azureus\tmp\AZU30146.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Azureus\tmp\AZU30147.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Azureus\tmp\AZU30148.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Azureus\tmp\AZU30149.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\cert8.db Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\history.dat Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\key3.db Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\parent.lock Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\search.sqlite Object is locked skipped
  C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\urlclassifier2.sqlite Object is locked skipped
  C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\pending.dat Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_4838_137D_3813_68E8\dfsr.db Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_4838_137D_3813_68E8\fsr.log Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_4838_137D_3813_68E8\fsrtmp.log Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_4838_137D_3813_68E8\tmp.edb Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\real\members.stg Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\shadow\members.stg Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\Cache\_CACHE_001_ Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\Cache\_CACHE_002_ Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\Cache\_CACHE_003_ Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\rk4nu6x1.default\Cache\_CACHE_MAP_ Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012007080520070806\index.dat Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\hsperfdata_Owner\2684 Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\ssu43.tmp Infected: not-a-virus:AdWare.Win32.Zearch.10 skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\sta2B.exe Infected: not-a-virus:AdWare.Win32.Lop.ag skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\sta36.exe Infected: not-a-virus:AdWare.Win32.Lop.m skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\sta37.exe Infected: not-a-virus:AdWare.Win32.Lop.m skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\sta707.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\wh.exe/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\wh.exe/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\wh.exe/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\wh.exe/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\wh.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\wh.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\wh.exe RarSFX: infected - 6 skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\~DF38E7.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\~DF38F3.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\~DF833F.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\~DF848F.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\~DFD972.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\~DFE090.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temp\~DFE32E.tmp Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\CDW7ENSZ\ADSAdClient31[1].htm Object is locked skipped
  C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\Owner\My Documents\Azureus Downloads\The Lord of the Rings -- The Two Towers (Extended Edition)\The Lord Of The Rings - The Two Towers - Extended CD1.avi Object is locked skipped
  C:\Documents and Settings\Owner\My Documents\Azureus Downloads\The Lord of the Rings -- The Two Towers (Extended Edition)\The Lord Of The Rings - The Two Towers - Extended CD2.avi Object is locked skipped
  C:\Documents and Settings\Owner\My Documents\Azureus Downloads\The Lord of the Rings -- The Two Towers (Extended Edition)\The Lord Of The Rings - The Two Towers - Extended CD3.avi Object is locked skipped
  C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
  C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped
  C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
  C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
  C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
  C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
  C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
  C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\chandir.dat Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\chandir.idx Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\chn.dat Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\chn.idx Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\D0000000.FCS Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\inuse.txt Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\L0000017.FCS Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\main.log Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs.dat Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs.idx Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs_die.dat Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs_die.idx Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs_dnd.dat Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs_dnd.idx Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs_ext.dat Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs_ext.idx Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs_rcv.dat Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\prs_rcv.idx Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\storydb.dat Object is locked skipped
  C:\Program Files\Compaq Connections\1940576\Users\Default\Data\storydb.idx Object is locked skipped
  C:\Program Files\Norton Personal Firewall\nisum.dat Object is locked skipped
  C:\RECYCLER\S-1-5-21-2279204656-959857132-3194884997-1003\Dc12\Live software find.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\RECYCLER\S-1-5-21-2279204656-959857132-3194884997-1003\Dc13\bqzghvgi.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\RECYCLER\S-1-5-21-2279204656-959857132-3194884997-1003\Dc13\LoudLessFirst.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\RECYCLER\S-1-5-21-2279204656-959857132-3194884997-1003\Dc13\LoudRoam64.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\RECYCLER\S-1-5-21-2279204656-959857132-3194884997-1003\Dc13\Wipe Anti Play.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\RECYCLER\S-1-5-21-2279204656-959857132-3194884997-1003\Dc14\mode info.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP309\A0104844.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP311\A0104889.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP311\A0104897.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP311\A0104908.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP311\A0104936.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP311\A0104944.exe Infected: Trojan.Win32.Obfuscated.en skipped
  C:\System Volume Information\_restore{F0C669DE-0A35-41EA-937E-C1296D6909A5}\RP311\change.log Object is locked skipped
  C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
  C:\WINDOWS\SchedLgU.Txt Object is locked skipped
  C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
  C:\WINDOWS\Sti_Trace.log Object is locked skipped
  C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
  C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
  C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\default Object is locked skipped
  C:\WINDOWS\system32\config\default.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SAM Object is locked skipped
  C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\SECURITY Object is locked skipped
  C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
  C:\WINDOWS\system32\config\software Object is locked skipped
  C:\WINDOWS\system32\config\software.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\system Object is locked skipped
  C:\WINDOWS\system32\config\system.LOG Object is locked skipped
  C:\WINDOWS\system32\drivers\etc\1.hosts Infected: Trojan-Clicker.Win32.Qhost.e skipped
  C:\WINDOWS\system32\h323log.txt Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
  C:\WINDOWS\wiadebug.log Object is locked skipped
  C:\WINDOWS\wiaservc.log Object is locked skipped
  C:\WINDOWS\WindowsUpdate.log Object is locked skipped
  
  Scan process completed.
  
  -------------------------------------------------------------------
  4. Logfile of HijackThis v1.99.1
  Scan saved at 22:58:06, on 05/08/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Norton Personal Firewall\NISUM.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\Program Files\defwatch.exe
  C:\Program Files\rtvscan.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  C:\windows\system\hpsysdrv.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\System32\hphmon05.exe
  C:\WINDOWS\system32\ps2.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\ALCXMNTR.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
  C:\PROGRA~1\vptray.exe
  C:\Program Files\SmartFix\bin\McciTrayApp.exe
  C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\MsgSys.EXE
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Azureus\Azureus.exe
  C:\WINDOWS\system32\notepad.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\Documents and Settings\Owner\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qsg10.hpwis.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mysingtel.com.sg
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by mysingtel
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
  O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
  O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
  O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
  O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\vptray.exe
  O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe
  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [hopevga] C:\DOCUME~1\Owner\APPLIC~1\BONEBR~1\Wipe Anti Play.exe
  O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://www.mysingtel.com.sg
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\defwatch.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\NISUM.EXE
  O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\rtvscan.exe
  O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  ----------------------------------------------------
  
  Thanks xiaomayi
• ndmmxiaomayi

  5 Aug 07, 23:40

  LOL, it's indeed your longest post.
  
  Open HijackThis and select Do a system scan only.
  
  Put a tick next to these lines:
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
  O4 - HKCU\..\Run: [hopevga] C:\DOCUME~1\Owner\APPLIC~1\BONEBR~1\Wipe Anti Play.exe
  
  Delete these files and folder.
  
  C:\Documents and Settings\Owner\Local Settings\Temp\ssu43.tmp
  C:\Documents and Settings\Owner\Local Settings\Temp\sta2B.exe
  C:\Documents and Settings\Owner\Local Settings\Temp\sta36.exe
  C:\Documents and Settings\Owner\Local Settings\Temp\sta37.exe
  C:\Documents and Settings\Owner\Local Settings\Temp\sta707.exe
  C:\Documents and Settings\Owner\Local Settings\Temp\wh.exe
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EB80000.VBN
  C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F980000.VBN
  C:\DOCUMENTS AND SETTINGS\Owner\APPLICATION DATA\BONEBR~1 <-- name of this folder starts with BONEBR
  
  Please post back a new HijackThis log in your next reply.
• relgn

  6 Aug 07, 13:17

  Logfile of HijackThis v1.99.1
  Scan saved at 13:16:35, on 06/08/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Norton Personal Firewall\NISUM.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\Program Files\defwatch.exe
  C:\Program Files\rtvscan.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  C:\windows\system\hpsysdrv.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\System32\hphmon05.exe
  C:\WINDOWS\system32\ps2.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\ALCXMNTR.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
  C:\PROGRA~1\vptray.exe
  C:\Program Files\SmartFix\bin\McciTrayApp.exe
  C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\MsgSys.EXE
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Azureus\Azureus.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
  C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
  C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
  C:\Documents and Settings\Owner\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qsg10.hpwis.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mysingtel.com.sg
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by mysingtel
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
  O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
  O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
  O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
  O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\vptray.exe
  O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe
  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://www.mysingtel.com.sg
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\defwatch.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\NISUM.EXE
  O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\rtvscan.exe
  O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  
  thanks xiaomayi
• relgn

  6 Aug 07, 13:19

  oh ya, after i delete the file and scan the system yesterday, i find that i cant accesss wikipedia anymore on mozilla. Why is that so? Internet explorer no problem.
• ndmmxiaomayi

  6 Aug 07, 15:47

  Originally posted by relgn:

  oh ya, after i delete the file and scan the system yesterday, i find that i cant accesss wikipedia anymore on mozilla. Why is that so? Internet explorer no problem.

  Clean!
  
  Hmm... let's see...
  
  How about this direct link?
  
  http://www.wikipedia.org/
  
  I've cleared both cache and cookies in Firefox and Internet Explorer...
• relgn

  6 Aug 07, 16:06

  Still cannot, it shows the following
  ------------------------------------------------------------------
  File not found
  
  Firefox can't find the file at /.
  
  * Check the file name for capitalisation or other typing errors.
  
  * Check to see if the file was moved, renamed or deleted.
  --------------------------------------------------------------------
  
  
• ndmmxiaomayi

  6 Aug 07, 16:09

  Originally posted by relgn:

  Still cannot, it shows the following
  ------------------------------------------------------------------
  File not found
  
  Firefox can't find the file at /.
  
  * Check the file name for capitalisation or other typing errors.
  
  * Check to see if the file was moved, renamed or deleted.
  --------------------------------------------------------------------

  File not found? It's a website link.
• relgn

  6 Aug 07, 20:01

  yar lorh, wtf is that larh. sian~
• ndmmxiaomayi

  12 Aug 07, 13:35

  http://www.sgforums.com/?action=thread_display&thread_id=273658
  
  MSN virus removal tool.