Help! Website Keep Popping Out By Itself!!
-
Think comp infected with virus.... or something...
Both FF and IE browser... everytime I try to surf.... automatic one... got new tab come out.... shows a page...winvirus or a site asking me to download the antivirus software.... well obviously... its a virus i know...
But how to make it go away?.. cookies ar?.. Any more free anti spyware program u all recommend? -
Read stickies.
-
Step 1
- [*]Please download the latest copy of HijackThis from Trend Micro and save it to your desktop.
[*]Double click on HJTInstall.exe to install it. Once installed, it will start automatically.
[*]Close HijackThis.
[*]Please go to C:\Program Files\Trend Micro\HijackThis and right click on HijackThis.exe. Select Rename.
[*]Type in scanner and press Enter.
[*]Double click on scanner to run it.
[*]Select Do a system scan and save a logfile. Please post back this log in your next reply.
Step 2- [*]Click on the Config... button at the bottom right hand corner.
[*]At the top, click on the Misc Tools button.
[*]Look under System tools.
[*]Click on the Open Uninstall Manager... button.
[*]Click on the Save list... button.
[*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
[*]Notepad will open. Please post this list in your next reply. -
It's not virus, its spyware/malware.
Use spysweeper -
Step 1
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:43:35 AM, on 14/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\kjddtfri.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Trend Micro\HijackThis\scanner.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.sg/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07FE92EF-E58D-43FC-BF55-A37C104BEE74} - C:\WINDOWS\system32\wvuuutr.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
O2 - BHO: (no name) - {4E1822C7-04D5-4035-BEDB-51FB6A317A72} - C:\WINDOWS\system32\pmnlj.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\xhdtlwrm.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [SetDefaultPrinter] c:\hp\bin\cloaker.exe c:\windows\system32\cmd.exe /c c:\hp\bin\defaultprinter\SetDefaultPrinter.cmd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\kxrcpjkt.dll",forkonce
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: Sid Registration.lnk = E:\ATR1.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: CaSup.lnk = C:\hp\region\CustAtStartUp.wsf
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmessg.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmessg.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} (Walt Disney Internet Group Hardware Control) - https://disneyblast.go.com/v3/setup/activex/DIGHardwareControl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://media.dragonback.net/flash/2/DinerDash2.1.0.0.67.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1189594875640
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/activex/dmcc2.cab?Version=1,0,0,10
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ctucorp.webex.com/client/T25L/webex/ieatgpc.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CA9E006-8B76-45DF-884A-FB5F6B83914E}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{3CA9E006-8B76-45DF-884A-FB5F6B83914E}: NameServer = 202.188.0.133,202.188.1.5
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: pmnlj - C:\WINDOWS\system32\pmnlj.dll
O20 - Winlogon Notify: winhoo32 - winhoo32.dll (file missing)
O20 - Winlogon Notify: wvuuutr - C:\WINDOWS\SYSTEM32\wvuuutr.dll
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\kjddtfri.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - c:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 14442 bytes -
step 2
µTorrent
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0.9
Adobe Shockwave Player
Agere Systems PCI Soft Modem
Belarc Advisor 7.2
BitLord 1.1
BitSpirit v3.2.2.215 Stable
Black & White 2
Blackhawk Striker 2 from Hewlett-Packard Desktops (remove only)
Blasterball 2 from Hewlett-Packard Desktops (remove only)
Blasterball 2 Remix from Hewlett-Packard Desktops (remove only)
Bonnies Bookstore
Bounce Symphony from Hewlett-Packard Desktops (remove only)
Burger Island
Caesar IV
Cathy's Caribbean Club
CC_ccProxyMSI
CC_ccStart
ccCommon
Command & Conquer The First Decade
Crystal Maze from Hewlett-Packard Desktops (remove only)
DIG Game Manager
Diner Dash 2
DivX Content Uploader
DivX Web Player
Download Accelerator Plus (DAP)
EPSON Printer Software
Fairy Godmother Tycoon
FlashGet 1.8.2.1002
FLV Player
FXCM Trading Station II
Game Console - WildGames
Help and Support Additions
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP Deskjet Preloaded Printer Drivers
HP Image Zone 4.2.3
HP Image Zone Plus 4.2.3
HP Photosmart Cameras 4.0
HP PSC & OfficeJet 4.0
HP Software Update
HPIZ423
Image Resizer Powertoy for Windows XP
Intel(R) Graphics Media Accelerator Driver
Internet Explorer 7 Beta 2
Internet Worm Protection
InterVideo DiscLabel
InterVideo Home Theater
InterVideo WinDVD Creator
InterVideo WinDVD Player
iTunes
J2SE Runtime Environment 5.0 Update 7
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 2
KBD
KBSR Mathematics Year 5
LiveReg (Symantec Corporation)
LiveUpdate 3.0 (Symantec Corporation)
Macromedia Dreamweaver 8
Macromedia Extension Manager
Medieval II Total War
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Encarta Encyclopedia Standard 2005
Microsoft Money
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works
mIRC
Mozilla Firefox (2.0.0.6)
MSN
MSRedist
Nanny Mania
New.net Domains 7.48
Norton AntiVirus 2005
Norton AntiVirus 2005 (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Personal Firewall
Norton Personal Firewall (Symantec Corporation)
Norton Security Center
Norton WMI Update
On2 VP7 Personal Edition
Optima KBSR Science Year 4
Orbital from Hewlett-Packard Desktops (remove only)
Overball from Hewlett-Packard Desktops (remove only)
Paws and Claws Pet School (remove only)
PC-Doctor for Windows
PFConfig 1.0.149
Photosmart 320,370,7400,8100,8400 Series
Polar Bowler from Hewlett-Packard Desktops (remove only)
Polar Golfer from Hewlett-Packard Desktops (remove only)
Private Eye
PS2
Python 2.2 combined Win32 extensions
Python 2.2.1
QuickTime
Real Lives 2004
RealPlayer
Road Ready Streetwise from Hewlett-Packard Desktops (remove only)
Security Update for Step By Step Interactive Training (KB89845
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB89635
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB89642
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Shockwave
Shrek 2 Ogre Bowler from Hewlett-Packard Desktops (remove only)
Shrek 2(TM): Team Action (TM)
Sid Meier's Pirates!
Sonic Express Labeler
Sonic RecordNow!
SPBBC
SpeederXP 1.80
Spybot - Search & Destroy 1.4
Stronghold Crusader
Stronghold Legends
Super Granny from Hewlett-Packard Desktops (remove only)
Symantec
SymNet
The Godfather™ The Game
The Guild 2
Time to Ride
Tradewinds from Hewlett-Packard Desktops (remove only)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Updates from HP
VideoLAN VLC media player 0.8.6a
WebEx
WildTangent GameChannel (remove only)
Windows Defender Signatures
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB883667
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Yahoo! Extras
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar -
Uninstall these programs:
New.net Domains 7.48
Internet Explorer Beta 2
Then do the following:
Please download Combofix from Tech Support Forum or Bleeping Computer. Save it to your desktop.
Double click to run it. Follow the prompts. Once done, it will reboot and a log will be produced. Please post that log and a new HijackThis log in your next reply.
Do not mouse click on Combofix while it is running. That may cause it to stall.
Post back the Combofix log and a new HijackThis log. -
HP users should drop dead!
Btw, I think you are a very kiasu person. -
I think mine was cured using just Spyware Doctor.....
-
ComboFix 07-09-13.3 - "HP_Owner" 2007-09-14 3:02:41.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.61.1033.18.189 [GMT 8:00]
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\d.exe
C:\DOCUME~1\HP_Owner\APPLIC~1\macromedia\Flash Player\#SharedObjects\JWB7SQVM\www.broadcaster.com
C:\DOCUME~1\HP_Owner\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\HP_Owner\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\newdotnet
C:\Program Files\newdotnet\newdotnet7_48.dll_tobedeleted_old
C:\Program Files\screensavers.com
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\cbxyvwt.dll
C:\WINDOWS\system32\dejwshxx.exe
C:\WINDOWS\system32\dhopnmds.dll
C:\WINDOWS\system32\djqlqaoc.exe
C:\WINDOWS\system32\evlqcfci.exe
C:\WINDOWS\system32\fgjcytlh.dll
C:\WINDOWS\system32\gdnkanrx.exe
C:\WINDOWS\system32\gxadyjfq.exe
C:\WINDOWS\system32\hdjovqjv.exe
C:\WINDOWS\system32\idismomv.exe
C:\WINDOWS\system32\inkuejaa.exe
C:\WINDOWS\system32\jlnmp.bak1
C:\WINDOWS\system32\jlnmp.bak2
C:\WINDOWS\system32\jlnmp.ini
C:\WINDOWS\system32\khfgghi.dll
C:\WINDOWS\system32\kjddtfri.exe
C:\WINDOWS\system32\kxrcpjkt.dll
C:\WINDOWS\system32\lcpbmoqh.exe
C:\WINDOWS\system32\ossepgij.exe
C:\WINDOWS\system32\phjvhdbs.exe
C:\WINDOWS\system32\pmnlj.dll
C:\WINDOWS\system32\rqviwitp.exe
C:\WINDOWS\system32\sdmnpohd.ini
C:\WINDOWS\system32\sndydvru.exe
C:\WINDOWS\system32\tkjpcrxk.ini
C:\WINDOWS\system32\urqropp.dll
C:\WINDOWS\system32\vwijleel.exe
C:\WINDOWS\system32\wvuuutr.dll
C:\WINDOWS\system32\xhdtlwrm.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_DOMAINSERVICE
((((((((((((((((((((((((( Files Created from 2007-08-13 to 2007-09-13 )))))))))))))))))))))))))))))))
.
2007-09-14 03:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-14 02:40 d-------- C:\Program Files\Trend Micro
2007-09-13 14:49 d-------- C:\DOCUME~1\HP_Owner\APPLIC~1\Sandlot Games
2007-09-13 14:49 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
2007-09-13 11:58 d-------- C:\DOCUME~1\HP_Owner\Contacts
2007-09-13 11:57 d----c--- C:\WINDOWS\system32\DRVSTORE
2007-09-09 07:41 d-------- C:\DOCUME~1\HP_Owner\APPLIC~1\MysteryStudio
2007-09-08 18:45 d-------- C:\DOCUME~1\HP_Owner\APPLIC~1\WildTangent
2007-09-08 18:44 d-------- C:\Program Files\WildGames
2007-09-08 18:44 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WildTangent
2007-08-31 22:07 684 --a------ C:\WINDOWS\mozver.dat
2007-08-30 09:12 d-------- C:\DOCUME~1\HP_Owner\APPLIC~1\Lionhead Studios
2007-08-28 15:56 574,508 --a------ C:\WINDOWS\system32\ttaagpug.exe
2007-08-17 09:22 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2007-08-16 23:28 d-------- C:\Program Files\GetRight
2007-08-16 23:12 d-------- C:\DOCUME~1\HP_Owner\APPLIC~1\GetRightToGo
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-14 02:55 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-13 11:58 --------- d-------- C:\Program Files\MSN Messenger
2007-09-12 22:36 --------- d-------- C:\Program Files\mIRC
2007-09-12 19:44 --------- d-------- C:\Program Files\Norton AntiVirus
2007-09-12 19:39 --------- d-------- C:\Program Files\Symantec
2007-09-09 16:45 --------- d-------- C:\Program Files\FlashGet
2007-09-08 19:16 --------- d-------- C:\DOCUME~1\HP_Owner\APPLIC~1\PlayFirst
2007-09-08 19:16 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
2007-08-31 22:07 --------- d-------- C:\Program Files\DivX
2007-08-18 11:46 --------- d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-18 11:46 --------- d-------- C:\Program Files\Gamenext
2007-08-16 22:53 --------- d-------- C:\DOCUME~1\HP_Owner\APPLIC~1\uTorrent
2007-08-16 22:37 --------- d-------- C:\Program Files\DAP
2007-08-16 16:19 --------- d-------- C:\DOCUME~1\HP_Owner\APPLIC~1\AdobeUM
2007-08-09 16:06 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\NannyMania
2007-08-03 00:27 --------- d-------- C:\Program Files\AviSynth 2.5
2007-08-02 23:31 --------- d-------- C:\Program Files\eRightSoft
2007-07-30 21:14 --------- d-------- C:\Program Files\DemocracyDemo
2007-07-28 17:54 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\NFS Underground
2007-07-13 19:25 --------- d-------- C:\Program Files\WildTangent
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 12:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 12:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 12:00]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 16:04]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-11-02 08:59]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 20:44]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 20:38]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 20:02]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-10-30 05:12]
"Home Theater SchSvr"="C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2004-09-23 10:22]
"WINREMOTE"="C:\Program Files\InterVideo\Common\Bin\WinRemote.exe" [2004-10-19 11:28]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-06-04 19:38]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 17:32]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 17:06 C:\WINDOWS\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-07-29 00:40 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-07-29 01:34 C:\WINDOWS\ALCWZRD.EXE]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 21:54]
"SetDefaultPrinter"="c:\hp\bin\cloaker.exe" [1999-11-07 07:11]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-10-30 05:28]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-09-12 19:38]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-11-02 09:03]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 22:57]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 16:57]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-08-29 19:54]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
S3 GameConsoleService;GameConsoleService;"C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db991745-f7ab-11da-9372-0013d41c769a}]
AutoRun\command- J:\innodisk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA844-CC51-11CF-AAFA-00AA00B6015C}]
rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\CChat25.inf,PerUserRemove
.
Contents of the 'Scheduled Tasks' folder
"2007-08-31 12:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - HP_Owner.job"
- c:\PROGRA~1\NORTON~1\Navw32.exe
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-14 03:16:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-09-14 3:17:58 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-14 03:17
.
--- E O F --- -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:20:39 AM, on 14/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\scanner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.sg/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [SetDefaultPrinter] c:\hp\bin\cloaker.exe c:\windows\system32\cmd.exe /c c:\hp\bin\defaultprinter\SetDefaultPrinter.cmd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: Sid Registration.lnk = E:\ATR1.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: CaSup.lnk = C:\hp\region\CustAtStartUp.wsf
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmessg.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmessg.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} (Walt Disney Internet Group Hardware Control) - https://disneyblast.go.com/v3/setup/activex/DIGHardwareControl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://media.dragonback.net/flash/2/DinerDash2.1.0.0.67.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1189594875640
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/activex/dmcc2.cab?Version=1,0,0,10
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ctucorp.webex.com/client/T25L/webex/ieatgpc.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CA9E006-8B76-45DF-884A-FB5F6B83914E}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{3CA9E006-8B76-45DF-884A-FB5F6B83914E}: NameServer = 202.188.0.133,202.188.1.5
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - c:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 12582 bytes -
Please go to Virus Total or Jotti and upload C:\WINDOWS\system32\ttaagpug.exe for scanning.
For Virus Total- [*]Please copy and paste C:\WINDOWS\system32\ttaagpug.exe in the text box next to the Browse button.
[*]Click on Send File.
For Jotti- [*]Please copy and paste C:\WINDOWS\system32\ttaagpug.exe in the text box next to the Browse button.
[*]Click on Submit. -
File ttaagpug.exe_ received on 09.14.2007 11:56:25 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 12/32 (37.5%)
Antivirus Version Last Update Result
AhnLab-V3 2007.9.14.0 2007.09.14 -
AntiVir 7.6.0.10 2007.09.14 TR/Spy.Agent.HZ.7
Authentium 4.93.8 2007.09.14 -
Avast 4.7.1043.0 2007.09.13 -
AVG 7.5.0.485 2007.09.14 -
BitDefender 7.2 2007.09.14 Trojan.Spy.Agent.HZ
CAT-QuickHeal 9.00 2007.09.13 -
ClamAV 0.91.2 2007.09.14 -
DrWeb 4.33 2007.09.14 -
eSafe 7.0.15.0 2007.09.13 -
eTrust-Vet 31.1.5135 2007.09.14 -
Ewido 4.0 2007.09.13 -
FileAdvisor 1 2007.09.14 -
Fortinet 3.11.0.0 2007.09.14 -
F-Prot 4.3.2.48 2007.09.13 -
F-Secure 6.70.13030.0 2007.09.14 -
Ikarus T3.1.1.12 2007.09.14 Trojan-Spy.Win32.Agent.hz
Kaspersky 4.0.2.24 2007.09.14 -
McAfee 5119 2007.09.13 New Malware.n
Microsoft 1.2803 2007.09.14 -
NOD32v2 2529 2007.09.13 -
Norman 5.80.02 2007.09.13 W32/Suspicious_U.gen
Panda 9.0.0.4 2007.09.13 Adware/WinAntiVirus2007
Prevx1 V2 2007.09.14 -
Rising 19.40.42.00 2007.09.14 -
Sophos 4.21.0 2007.09.14 Mal/Packer
Sunbelt 2.2.907.0 2007.09.13 VIPRE.Suspicious
Symantec 10 2007.09.14 Infostealer.Gampass
TheHacker 6.2.5.059 2007.09.14 W32/Behav-Heuristic-060
VBA32 3.12.2.4 2007.09.13 -
VirusBuster 4.3.26:9 2007.09.13 Packed/Upack
Webwasher-Gateway 6.0.1 2007.09.14 Trojan.Spy.Agent.HZ.7 -
Step 1
Show hidden files and folders- [*]Open My Computer.
[*]Go to Tools > Folder Options.
[*]Select the View tab.
[*]Scroll down to Hidden files and folders.
[*]Select Show hidden files and folders.
[*]Uncheck (untick) Hide extensions of known file types.
[*]Uncheck (untick) Hide protected operating system files (Recommended).
[*]Click Yes when prompted.
[*]Click OK.
[*]Close My Computer.
Delete this file.
C:\WINDOWS\system32\ttaagpug.exe
Step 2- [*]Please download AVG Anti-Spyware and save it to your desktop.
[*]Double click on avgas-setup-7.5.0.50.exe to install AVG Anti-Spyware. Install it in the default location.
[*]Once installed, start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
[*]In the main screen, you should see Your Computer's Security.- [*]Next to Resident Shield, click on Change state. It should now be Inactive.
[*]Next to Automatic Updates, click on Change state. It should now be Inactive.
[*]Next to Last Update, click on Update now. If your firewall prompts you, tell your firewall to allow it. Should you be unable to update it, download the updates from here. Save it to your desktop. Double click to run the installation and the updates will be installed. Make sure AVG Anti-Spyware is closed during the installation.
[*]Right-click the AVG Anti-Spyware icon near the clock and uncheck (untick) Start with Windows. Confirm by clicking Yes.
[*]Select the Settings tab.
[*]Under How to act?, click on Recommended actions and select Quarantine.
[*]Under How to scan?, check (tick) all the boxes.
[*]Under Possibly unwanted software:, check (tick) all the boxes.
[*]Under Reports:, uncheck (untick) the Only if threats were found box and select Do not automatically generate report.
[*]Under What to scan?, select Scan every file.
[*]Click on the Scanner button at the top.
[*]Select the Scan tab.
[*]Click on Complete System Scan to start the scan.
[*]When the scan has finished, follow the instructions below.
IMPORTANT: Don't click on the Save Scan Report button before you did hit the Apply all Actions button.- [*]Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
[*]At the bottom of the window click on the Apply all Actions button. (3)
- [*]Click the Save Report as button.
[*]Save the report to your Desktop. -
EDIT
-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:37:45 PM, on 14/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymSCUI.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\rsvp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.sg/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [SetDefaultPrinter] c:\hp\bin\cloaker.exe c:\windows\system32\cmd.exe /c c:\hp\bin\defaultprinter\SetDefaultPrinter.cmd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: Sid Registration.lnk = E:\ATR1.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: CaSup.lnk = C:\hp\region\CustAtStartUp.wsf
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmessg.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmessg.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} (Walt Disney Internet Group Hardware Control) - https://disneyblast.go.com/v3/setup/activex/DIGHardwareControl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://media.dragonback.net/flash/2/DinerDash2.1.0.0.67.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1189594875640
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/activex/dmcc2.cab?Version=1,0,0,10
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ctucorp.webex.com/client/T25L/webex/ieatgpc.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CA9E006-8B76-45DF-884A-FB5F6B83914E}: NameServer = 202.188.0.133,202.188.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{3CA9E006-8B76-45DF-884A-FB5F6B83914E}: NameServer = 202.188.0.133,202.188.1.5
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - c:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 12987 bytes -
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 9:35:33 PM 14/09/2007
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{722D2939-A14A-41A9-9EAC-AB8F4E295819} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{88D758A3-D33B-45FD-91E3-67749B4057FA} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{ECFC80AC-3D66-41BC-913F-4996461823CF}\RP378\A0127695.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{ECFC80AC-3D66-41BC-913F-4996461823CF}\RP391\A0133431.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{ECFC80AC-3D66-41BC-913F-4996461823CF}\RP391\A0133432.dll -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{ECFC80AC-3D66-41BC-913F-4996461823CF}\RP391\A0133428.exe -> Downloader.Tiny.id : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\WINDOWS\system32\gxadyjfq.exe.vir -> Downloader.Tiny.id : Cleaned with backup (quarantined).
C:\Program Files\EA Games\Command & Conquer The First Decade\Command & Conquer(tm) Tiberian Sun(tm)\SUN\ccts2.exe -> Logger.Hatkeys.C : Cleaned with backup (quarantined).
:mozilla.330:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.331:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.332:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.333:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.334:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.335:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.336:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.337:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.338:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.339:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.340:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.341:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.342:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.343:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.344:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.345:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.346:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.347:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.348:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.349:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.350:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.351:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.352:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.353:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.354:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.355:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.356:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.357:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.358:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.359:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.360:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.361:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.362:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.363:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.364:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.365:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.366:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.367:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.368:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.369:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.370:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.371:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.372:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.373:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.374:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.375:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.376:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.377:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.414:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.558:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.617:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.140:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.82:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.83:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.84:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.85:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][3].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][2].txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.599:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
:mozilla.600:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@adengage[1].txt -> TrackingCookie.Adengage : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][2].txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.529:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.530:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.531:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.532:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.533:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.534:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.511:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.512:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.502:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.503:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.504:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.18:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.648:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.649:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.650:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.233:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.234:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.235:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.236:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.237:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.238:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.239:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@clickbank[2].txt -> TrackingCookie.Clickbank : Cleaned.
:mozilla.204:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.869:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.870:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.727:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned.
:mozilla.75:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.739:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.55:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.56:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.57:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.58:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.59:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.60:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.61:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.62:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.63:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.64:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.469:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fortunecity : Cleaned.
:mozilla.470:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Fortunecity : Cleaned.
:mozilla.632:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.253:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.254:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.255:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.523:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.663:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.190:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.100:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.99:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.482:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.Information : Cleaned.
:mozilla.667:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][2].txt -> TrackingCookie.Live : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][3].txt -> TrackingCookie.Live : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.312:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.313:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.477:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.537:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.538:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.539:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.540:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.541:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.542:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.543:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.Pstats : Cleaned.
:mozilla.282:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.283:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.16:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.20:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.535:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.481:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.461:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.462:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.463:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.464:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.465:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.466:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.467:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.468:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.484:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.485:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.486:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.487:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.488:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.489:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.706:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.707:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.708:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.709:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.710:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.628:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
:mozilla.629:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
:mozilla.630:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
:mozilla.631:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
:mozilla.212:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.213:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.214:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.215:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.216:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.218:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.219:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.220:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.221:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.222:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.223:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.224:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.225:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.226:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.579:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.580:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.581:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.582:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][2].txt -> TrackingCookie.Tracking101 : Cleaned.
:mozilla.777:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.265:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.270:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.273:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.274:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.275:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.276:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.277:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.278:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.279:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.506:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\hp_owner@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.326:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\HP_Owner\Cookies\[email protected][1].txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.171:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.172:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.173:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.174:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.175:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.176:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.177:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.178:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.554:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.555:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.557:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\x3ypkhx5.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\Alcohol Soft\Alcohol 120\star_syn_client.dll -> Trojan.Agent.abd : Cleaned with backup (quarantined).
C:\Program Files\Alcohol Soft\Alcohol 120\star_syn_client.dll.BAK -> Trojan.Agent.abd : Cleaned with backup (quarantined).
::Report end -
seems like u downloaded a unknown codec from the web?Originally posted by mhcampboy:Think comp infected with virus.... or something...
Both FF and IE browser... everytime I try to surf.... automatic one... got new tab come out.... shows a page...winvirus or a site asking me to download the antivirus software.... well obviously... its a virus i know...
But how to make it go away?.. cookies ar?.. Any more free anti spyware program u all recommend?
causing a trojan to infect your system -
Flush your system restore points as they are infected.
Flush the system restore points- [*]Right click on My Computer and select Properties.
[*]Select the System Restore tab.
[*]Check (tick) Turn off system restore on all drives box.
[*]Click OK.
[*]Restart your computer.
After restarting your computer, follow these steps:- [*]Right click on My Computer and select Properties.
[*]Select the System Restore tab.
[*]Uncheck (untick) Turn off system restore on all drives box.
[*]Click OK.
[*]Restart your computer.
Note: Do this only ONCE, don't flush it regularly. -
after tat?
-
You update your Symantec and scan. If there's nothing else, your computer is clean.
-
thank u mayi....
anyway...there are some files which appeared on my desktop... think when u set see all files thingy....
how to make them disappear again? -
STICK THIS THREAD!
-
What are those files? Desktop has no hidden files as far as I'm aware.Originally posted by mhcampboy:thank u mayi....
anyway...there are some files which appeared on my desktop... think when u set see all files thingy....
how to make them disappear again?
Can you please delete Combofix and this folder - C:\Qoobox -
solution
stop surfing pron sites