I am having problems with new icons that appeared today that say there are mailware threats, and a critical system error. I figured it was spyware, but cannot seem to get rid of it. Virus scan says that 3 files cannot be deleted, system32\odbc.exe, winser.exe, and wintrust32.exe. Is there a way of deleting these off my computer so that my system can function normally? Also, when I tried turning off my computer earlier, I got multiple messages saying that there were errors in shutting programs down, is this linked to my first problem? Logfile of HijackThis v1.99.1 Scan saved at 4:42:20 AM, on 10/23/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\odbc.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\system32\winser.exe C:\WINDOWS\system32\wintrust32.exe C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\MMediaCodec\isamonitor.exe C:\Program Files\MMediaCodec\pmsngr.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\MMediaCodec\pmmon.exe C:\Program Files\MMediaCodec\isamini.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\AOL\1131078402\ee\AOLSoftware.exe C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AIM\aim.exe C:\Program Files\ATI Multimedia\main\ATIDtct.EXE C:\Program Files\ATI Multimedia\main\ATISched.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\UltraMon\UltraMon.exe C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\UltraMon\UltraMonTaskbar.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\InterMute\SpySubtract\SpySub.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE c:\Program Files\Network Associates\VirusScan\shstat.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\HP_Administrator\Desktop\HijackThis_v1.99.1.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ati.com/online/registration R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\MMediaCodec\isaddon.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\MMediaCodec\iesplugin.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [HPHUPD08] "C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [ViewMgr] "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1131078402\ee\AOLSoftware.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [IPHSend] "C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CfgWiz.exe" /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI Multimedia\main\ATIDtct.EXE" O4 - HKCU\..\Run: [ATI Scheduler] "C:\Program Files\ATI Multimedia\main\ATISched.EXE" O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe" O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe O4 - Global Startup: UltraMon.lnk = C:\Program Files\UltraMon\UltraMon.exe O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\system32\dpfwu.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing) O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Neth - Unknown owner - C:\WINDOWS\system32\netid.exe (file missing) O23 - Service: ODBC service - Unknown owner - C:\WINDOWS\system32\odbc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: Win PPPe - Unknown owner - C:\WINDOWS\system32\winser.exe O23 - Service: WinTrust32 - Unknown owner - C:\WINDOWS\system32\wintrust32.exe O23 - Service: WUSB54GSCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe" "WUSB54GSC.exe (file missing) Thanks
Hello rfoster2, let's see if we can get this log cleaned up a bit. Download SmitfraudFix.zip to the desktop from here * Extract the files to the desktop. Download Killbox from here. * Do not run it yet, will later in safe mode. Disable SpySweepers Shield because it may interfere with our fixes. Please leave them off until the very end. Open SpySweeper. Click Shield Settings on the right (or Shields on the left, depending what screen you're on). Click Internet Explorer and uncheck all items. Click Windows System and uncheck all items. Click Hosts File and uncheck all items. Click Startup Programs and uncheck all items. Close SpySweeper. Press Ctrl+Alt+Del > Processes tab > End these: [bold]odbc.exe winser.exe wintrust32.exe [/bold] Close Task Manager. Go to Start > Run > type services.msc > click OK. Find the each of the following and double click to open. [bold]ODBC service Neth Win PPPe WinTrust32[/bold] Beside "Startup Type" click the drop down menu and select "Disabled" for each. Close Services. Open HijackThis. Click "Open the misc tools section". Click "Delete an NT service". Copy/Paste these one at a time and click OK. [bold]O23 - Service: ODBC service - Unknown owner - C:\WINDOWS\system32\odbc.exe O23 - Service: Neth - Unknown owner - C:\WINDOWS\system32\netid.exe (file missing) O23 - Service: Win PPPe - Unknown owner - C:\WINDOWS\system32\winser.exe O23 - Service: WinTrust32 - Unknown owner - C:\WINDOWS\system32\wintrust32.exe [/bold] A prompt may say that it was not found in registry. Do not worry about it, just continue to next one. You will be prompted to restart after each one. Do so after the last one and restart in safe mode(press F8 upon boot, select "Safe Mode" from menu and press Enter). [bold]Note[/bold]rint or copy these instructions to Notepad and save them. You will be in safe mode and can't access the internet. * Once in safe mode open the SmitfraudFix folder. * Double-click smitfraudfix.cmd * Select 2 and hit Enter to delete infect files. * You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection. * The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file. * A reboot may be needed to finish the cleaning process. Do not restart yet. The report can be found at the root of the system drive, usually at C:\rapport.txt. * Exit SmitfraudFix. Open Killbox.exe. Check "Standard File Kill". In the "Full Path of File to Delete" box, copy and paste each of the following lines below [bold]one at a time[/bold]. Then click the red button with a white X after you enter each file. You will be prompted to confirm, click Yes. [bold]C:\WINDOWS\system32\odbc.exe C:\WINDOWS\system32\winser.exe C:\WINDOWS\system32\wintrust32.exe [/bold] Note: KillBox may prompt "File does not seem to exist". If so, continue with next file, but do not miss any. Exit KillBox. Restart in normal mode. Post back with the contents of rapport.txt and a new HijackThis log.
I did what you said. The problem seems to be fixed, no more popups and no mor "mail" popup problem. Here are the two things you asked for, letr me know if it is truely fixed. Thanks SmitFraudFix v2.113 Scan done at 20:11:25.04, Mon 10/23/2006 Run from C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="contrabandists" [HKEY_CLASSES_ROOT\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32] @="C:\WINDOWS\system32\dpfwu.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32] @="C:\WINDOWS\system32\dpfwu.dll" »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri C:\WINDOWS\system32\dpfwu.dll -> Hoax.Win32.Renos.gen.d C:\WINDOWS\system32\dpfwu.dll -> Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted C:\Program Files\MMediaCodec\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End and Logfile of HijackThis v1.99.1 Scan saved at 8:26:39 PM, on 10/23/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\AOL\1131078402\ee\AOLSoftware.exe C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CfgWiz.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AIM\aim.exe C:\Program Files\ATI Multimedia\main\ATIDtct.EXE C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe C:\Program Files\ATI Multimedia\main\ATISched.EXE C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\UltraMon\UltraMon.exe C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\UltraMon\UltraMonTaskbar.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\InterMute\SpySubtract\SpySub.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Mozilla Firefox\firefox.exe c:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hphmon06.exe C:\Program Files\Java\jre1.5.0\bin\jusched.exe C:\Program Files\Java\jre1.5.0\bin\jucheck.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\HP_Administrator\Desktop\HijackThis_v1.99.1.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ati.com/online/registration R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [HPHUPD08] "C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [ViewMgr] "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1131078402\ee\AOLSoftware.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [IPHSend] "C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CfgWiz.exe" /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI Multimedia\main\ATIDtct.EXE" O4 - HKCU\..\Run: [ATI Scheduler] "C:\Program Files\ATI Multimedia\main\ATISched.EXE" O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe" O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe O4 - Global Startup: UltraMon.lnk = C:\Program Files\UltraMon\UltraMon.exe O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing) O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: WUSB54GSCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe" "WUSB54GSC.exe (file missing)
Looking better, but still not clean. Edit: please leave the shields off until we fully clean everything. Go here to download the trial version of [bold]AVG Anti-spyware[/bold]. Go here and download [bold]ATF Cleaner[/bold]. Do not run yet, will later. Go to Add/Remove Programs and uninstall(if you didn't install it): [bold]Viewpoint Manager Viewpoint Toolbar[/bold] Install and update AVGAS. After updating, close AVGAS, will run scan later in safe mode. Run a scan only with HijackThis, check these: [bold]O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll [/bold] <--Only if you uninstalled Viewpoint Toolbar. [bold]O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [/bold] <--Not bad, but not needed on startup. [bold]O4 - HKLM\..\Run: [ViewMgr] "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [/bold] <--Only if you uninstalled Viewpoint Manager. [bold]O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML [/bold] Close all windows except HijackThis, then click "Fix checked". [bold]Note[/bold]: Print or copy these instructions to Notepad and save them. Restart your computer in safe mode(press F8 upon boot, select "Safe Mode" from menu and press Enter). Open AVG AS and click "Scanner". Click "Complete System Scan". When it finishes scanning, set all items to "Quarantine". Click "Apply All Actions". Click "Save Report". Click "Save report as" and save it to the desktop. Close AVGAS. Delete this with KillBox. [bold]C:\Program Files\winupdates\winupdates.exe[/bold] Close KillBox. Show hidden files and folders. Control Panel > Folder Options > View tab > check "Show hidden files and folders". Locate and delete this folder. C:\Program Files\[bold]winupdates[/bold] Restart in normal mode. Delete the KillBox backups located at C:\!KillBox\[bold]backups[/bold] Empty the Recycle Bin. Open ATF Cleaner. Check "Select All". Click "Empty Selected". Go here and run Kaspersky Online Scanner. Accept the terms. After downloading, click "My Computer". After scanning, click "Save report as" and save it. Post back with the AVGAS report, the Kaspersky log, and a new HijackThis log. After you post the AVGAS log, you may uninstall AVGAS if you don't want to keep it. If you do keep it, turn off the real-time protections since you already have one anti-spyware program.
I did what you said but I could not get the kaspersky log because the program would not download onto my computer, it said it failed and I had to be the admin and IE settings had to be at medium, I did this and it would still not load up. Let me know these look, and what I need to do next. Thanks --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 12:46:16 AM 10/24/2006 + Scan result: C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP423\A0033126.exe -> Backdoor.Small.bh : Cleaned with backup (quarantined). C:\avtemp\setup.exe -> Backdoor.Small.bh : Cleaned with backup (quarantined). C:\temp\VirusScan\UIUC_VirusScan_80i.exe/avtemp/setup.exe -> Backdoor.Small.bh : Cleaned with backup (quarantined). :mozilla.709:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned. :mozilla.736:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.737:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.254:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.255:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.256:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.257:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.258:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.946:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned. :mozilla.868:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. :mozilla.715:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.716:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.717:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.906:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.458:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.459:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.25:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.26:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.27:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.28:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.30:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.31:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.32:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.815:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Adviva : Cleaned. :mozilla.49:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.395:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned. :mozilla.499:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.500:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.598:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.599:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.312:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.313:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.314:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.315:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.250:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.279:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.280:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Com : Cleaned. C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.29:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.597:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.54:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.55:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.56:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.57:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.58:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.244:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.245:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.246:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.247:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.248:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.249:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.358:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.434:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.435:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.634:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.635:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.646:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.727:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.728:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.84:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.85:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.91:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.92:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.93:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.390:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.391:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.392:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.393:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.394:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.226:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.228:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.229:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.259:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.385:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.386:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.316:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.317:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.318:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.319:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.320:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.321:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.322:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.720:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.266:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.267:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.268:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.269:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.399:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.400:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.401:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.119:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.121:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.127:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.140:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.141:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.142:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.146:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.150:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.237:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.238:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.239:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.240:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.241:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.242:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.289:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.776:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned. :mozilla.831:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.832:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.833:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.834:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned. :mozilla.843:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.155:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.156:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.157:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.158:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.159:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.160:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.474:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.475:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ewtsmwkk.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. C:\!KillBox\odbc.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined). C:\!KillBox\winser.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined). C:\!KillBox\wintrust32.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP423\A0033190.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP423\A0033191.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP423\A0033192.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined). ::Report end and Logfile of HijackThis v1.99.1 Scan saved at 1:52:37 AM, on 10/24/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\eHome\ehSched.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\HPZipm12.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Common Files\AOL\1131078402\ee\AOLSoftware.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CfgWiz.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AIM\aim.exe C:\Program Files\ATI Multimedia\main\ATIDtct.EXE C:\Program Files\ATI Multimedia\main\ATISched.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\UltraMon\UltraMon.exe C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe C:\Program Files\UltraMon\UltraMonTaskbar.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\InterMute\SpySubtract\SpySub.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\AGRSMMSG.exe c:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hphmon06.exe C:\Program Files\Java\jre1.5.0\bin\jusched.exe C:\Program Files\Java\jre1.5.0\bin\jucheck.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\HP_Administrator\Desktop\HijackThis_v1.99.1.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ati.com/online/registration R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [HPHUPD08] "C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1131078402\ee\AOLSoftware.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [IPHSend] "C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CfgWiz.exe" /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI Multimedia\main\ATIDtct.EXE" O4 - HKCU\..\Run: [ATI Scheduler] "C:\Program Files\ATI Multimedia\main\ATISched.EXE" O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe" O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe O4 - Global Startup: UltraMon.lnk = C:\Program Files\UltraMon\UltraMon.exe O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing) O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: WUSB54GSCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe" "WUSB54GSC.exe (file missing)
I could not do this either. Whenever I click on the activeX plugin install it will install, but when I get to the next step where I need to click install the program, I click it and the browser freezes up and says its not responding. This was what was happening to the last program too. What should I do?
Ok, well it sounds like something is stoping them from running, maybe malware. Go here and download [bold]Spybot Search and Destroy[/bold]. Install and open Spybot. Click "Search for Updates". Select all and click "Download Updates". After updating close Spybot. Restart in safe mode. Open Spybot and click "Check for Problems". When it finishes, click "Fix selected problems". Right click and select "Copy results" (not full report) Open Notepad, paste and save them. Restart in normal mode and try running either Kaspersky or ActiveScan again. Post back with the Spybot log and the online scan log(if sucessful).
Here is my spybot log, but I still cannot run either one of those online scans PestTrap: User settings (Registry value, fixed) HKEY_USERS\S-1-5-21-146727877-3976677185-1988998239-1008\Software\Microsoft\Windows\ShellNoRoam\MUICache\*\pmsngr.exe Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, fixed) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2 Avenue A, Inc.: Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed) Advertising.com: Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed) DoubleClick: Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed) Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed) Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed) Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed) Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed) Avenue A, Inc.: Tracking cookie (Firefox: default) (Cookie, fixed) DoubleClick: Tracking cookie (Firefox: default) (Cookie, fixed) FastClick: Tracking cookie (Firefox: default) (Cookie, fixed) FastClick: Tracking cookie (Firefox: default) (Cookie, fixed) FastClick: Tracking cookie (Firefox: default) (Cookie, fixed) FastClick: Tracking cookie (Firefox: default) (Cookie, fixed) FastClick: Tracking cookie (Firefox: default) (Cookie, fixed) MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed) --- Spybot - Search & Destroy version: 1.4 (build: 20050523) --- 2005-05-31 blindman.exe (1.0.0.1) 2005-05-31 SpybotSD.exe (1.4.0.3) 2005-05-31 TeaTimer.exe (1.4.0.2) 2006-10-24 unins000.exe (51.41.0.0) 2005-05-31 Update.exe (1.4.0.0) 2006-02-06 advcheck.dll (1.0.2.0) 2005-05-31 aports.dll (2.1.0.0) 2005-05-31 borlndmm.dll (7.0.4.453) 2005-05-31 delphimm.dll (7.0.4.453) 2005-05-31 SDHelper.dll (1.4.0.0) 2006-02-20 Tools.dll (2.0.0.2) 2005-05-31 UnzDll.dll (1.73.1.1) 2005-05-31 ZipDll.dll (1.73.2.0) 2006-10-20 Includes\Cookies.sbi (*) 2006-10-13 Includes\Dialer.sbi (*) 2006-10-20 Includes\DialerC.sbi (*) 2006-10-13 Includes\Hijackers.sbi (*) 2006-10-20 Includes\HijackersC.sbi (*) 2006-10-20 Includes\Keyloggers.sbi (*) 2006-10-20 Includes\KeyloggersC.sbi (*) 2006-10-13 Includes\Malware.sbi (*) 2006-10-20 Includes\MalwareC.sbi (*) 2006-10-20 Includes\PUPS.sbi (*) 2006-10-20 Includes\PUPSC.sbi (*) 2006-10-20 Includes\Revision.sbi (*) 2006-10-13 Includes\Security.sbi (*) 2006-10-20 Includes\SecurityC.sbi (*) 2006-10-13 Includes\Spybots.sbi (*) 2006-10-20 Includes\SpybotsC.sbi (*) 2005-02-17 Includes\Tracks.uti 2006-10-13 Includes\Trojans.sbi (*) 2006-10-20 Includes\TrojansC.sbi (*)
Make sure your IE settings are set to medium or low. Restart in safe mode with networking. Press F8 like you would enter safe mode, but choose "Safe Mode with Networking". Then, try running one of 'em.
