here is the hijackthis log file... Logfile of HijackThis v1.99.1 Scan saved at 9:59:08 PM, on 5/3/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Administrator\Desktop\HijackThis_v1.99.1.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu4.exe 61A847B5BBF72816228849360B8D1BE1C59331416DC57C032CBD1BE3D290641833 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)
Hello inoob Move HijackThis to own folder, for example C:\Hijackthis\Hijackthis.exe Please download AVG anti-spyware to your Desktop or to your usual Download Folder, from HERE [*]Install AVG Anti-Spyware by double clicking the installer. [*]Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked. [*]On the main screen under Your Computer's security. [*]Click on Change state next to Resident shield. It should now change to inactive. [*]Click on Change state next to Automatic updates. It should now change to inactive. [*]Next to Last Update, click on Update now. (You will need an active internet connection to perform this) [*]Wait until you see the Update succesfull message. [*]Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows. [*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes. If you are having problems with the updater, you can use this link to manually update AVG. AVG Anti-Spyware manual updates. Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update. Don't run a scan yet. Remove via Add/Remove program, if found: Oin Yazzle by Oin Purityscan by Oin Snowballwars by Oin or anything similar with Oin or Outerinfo in it. Zolero Tizzletalk MediaTickets Cowabanga Download and run this uninstaller: OiUninstaller.exe Tutorial for the uninstaller if needed. Open HijackThis, press do a system scan only, checkmark these lines: O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu4.exe 61A847B5BBF72816228849360B8D1BE1C59331416DC57C032CBD1BE3D290641833 O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe Close all other windows and press Fix checked. Show hidden files: 1. Click Start. 2. Open My Computer. 3. Select the Tools menu and click Folder Options. 4. Select the View Tab. 5. Under the Hidden files and folders heading select Show hidden files and folders. 6. Uncheck the Hide protected operating system files (recommended) option. 7. Click Yes to confirm. 8. Click OK. Reboot your computer in Safe mode: 1. Restart your computer. 2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. 3. Select the option for Safe Mode using the arrow keys. 4. Then press enter on your keyboard to boot into Safe Mode. Once in Safe mode. Delete following files/folders, if found: C:\WINDOWS\retadpu4.exe C:\Program Files\Ipwindows RUN AVG ANTI-SPYWARE Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan. [*]Click on Scanner on the toolbar. [*]Click on the Settings tab. [*]Under How to act? [*]Click on Recommended Action and choose Quarantine from the popup menu. [*]Under How to scan? [*]All checkboxes should be ticked. [*]Under Possibly unwanted software: [*]All checkboxes should be ticked. [*]Under Reports: [*]Select Automatically generate report after every scan and uncheck Only if threats were found. [*]Under What to scan? [*]Select Scan every file. [*]Click on the Scan tab. [*]Click on Complete System Scan to start the scan process. [*]Let the program scan the machine. [*]When the scan has finished, follow the instructions below. IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button. [*]Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2) [*]At the bottom of the window click on the Apply all Actions button. (3) [*]When done, click the Save Scan Report button. (4) [*]Click the Save Report as button. [*]Save the report to your Desktop. [*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes. Reboot in Normal Mode. Please post a fresh Hijackthis log and AVG Anti-Spyware report.
here are the avg and the hijackthis file i got a downloader and other stuff in quarantine like trojans and droppers --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 2:12:58 PM 5/6/2007 + Scan result: C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\2DBC9C7M\OiUninstaller[1].exe -> Adware.PurityScan : Cleaned with backup (quarantined). HKLM\SOFTWARE\Clickspring -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D3082973-2DB5-465B-8D74-4D7652B2B004}\RP94\A0014265.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D3082973-2DB5-465B-8D74-4D7652B2B004}\RP94\A0014266.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D3082973-2DB5-465B-8D74-4D7652B2B004}\RP93\A0014128.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D3082973-2DB5-465B-8D74-4D7652B2B004}\RP93\A0014136.exe -> Dropper.Delf.xo : Cleaned with backup (quarantined). C:\System Volume Information\_restore{D3082973-2DB5-465B-8D74-4D7652B2B004}\RP94\A0014147.exe -> Dropper.Delf.xo : Cleaned with backup (quarantined). :mozilla.152:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.26:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.41:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.88:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@americanexpress.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@ge.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@lenovo.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@msnaccountservices.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@prnewswire.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@eztracks.aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.297:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Adobe : Cleaned. :mozilla.298:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Adobe : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@www.adobe[2].txt -> TrackingCookie.Adobe : Cleaned. :mozilla.43:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.42:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Centrport : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@centrport[1].txt -> TrackingCookie.Centrport : Cleaned. :mozilla.45:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.46:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Com : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@as-eu.falkag[2].txt -> TrackingCookie.Falkag : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@s.as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@sel.as-eu.falkag[2].txt -> TrackingCookie.Falkag : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@hotlog[1].txt -> TrackingCookie.Hotlog : Cleaned. :mozilla.110:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.111:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.233:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Information : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@searchportal.information[2].txt -> TrackingCookie.Information : Cleaned. :mozilla.235:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.229:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Msn : Cleaned. :mozilla.230:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Msn : Cleaned. :mozilla.231:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Msn : Cleaned. :mozilla.232:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Msn : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@search.msn[1].txt -> TrackingCookie.Msn : Cleaned. :mozilla.170:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.171:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.177:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Overture : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@overture[2].txt -> TrackingCookie.Overture : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned. :mozilla.14:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.185:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned. :mozilla.186:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned. :mozilla.187:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@pro-market[2].txt -> TrackingCookie.Pro-market : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.201:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.202:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.203:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.204:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.205:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.206:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.207:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.208:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Real : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@guide.real[2].txt -> TrackingCookie.Real : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@real[2].txt -> TrackingCookie.Real : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@realguide.real[1].txt -> TrackingCookie.Real : Cleaned. :mozilla.209:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned. :mozilla.210:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned. :mozilla.211:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned. :mozilla.217:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Revenue : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@revenue[2].txt -> TrackingCookie.Revenue : Cleaned. :mozilla.218:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.219:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@revsci[1].txt -> TrackingCookie.Revsci : Cleaned. :mozilla.58:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.241:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.242:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.243:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.244:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.245:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.37:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@secure.skype[1].txt -> TrackingCookie.Skype : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@site.skype[1].txt -> TrackingCookie.Skype : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@skype[1].txt -> TrackingCookie.Skype : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@starware[2].txt -> TrackingCookie.Starware : Cleaned. :mozilla.262:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@toplist[1].txt -> TrackingCookie.Toplist : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.272:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tvxskri1.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@weborama[1].txt -> TrackingCookie.Weborama : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@yadro[1].txt -> TrackingCookie.Yadro : Cleaned. C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\RECYCLER\S-1-5-21-448539723-1060284298-1708537768-500\Dc1\UnInstall.exe -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-448539723-1060284298-1708537768-500\Dc1\ipwins.dll -> Trojan.Rond : Cleaned with backup (quarantined). C:\RECYCLER\S-1-5-21-448539723-1060284298-1708537768-500\Dc1\ipwins.exe -> Trojan.Rond : Cleaned with backup (quarantined). ::Report end Logfile of HijackThis v1.99.1 Scan saved at 2:17:53 PM, on 5/6/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\HJT\HijackThis_v1.99.1.exe C:\WINDOWS\system32\wuauclt.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)
Hi inoob I don't see a Firewall in your computer, so if you don't use anything firewall, please download one. I recommend one of these: Link Link Link Please Update your Java and Remove old Java Versions Download the latest version of Java Runtime Environment (JRE) 6u1 .<== scroll down the list to find THIS entry Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Remove older Java Versions: Close any programs you may have running - especially your web browser. Go to Start >> Control Panel double-click on Add/Remove Programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Install latest Java Version: From your desktop, double-click on jre-6-windows-i586.exe to install the newest version. Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. This online scanner working only for Internet Explorer Please run this online scan: Panda ActiveScan Once you are on the Panda site, click the Scan your PC button A new window will open...click the Check Now button Enter your Country Enter your State/Province Enter your e-mail address and click send Select either Home User or Company Click the big Scan Now button If it wants to install an ActiveX component allow it It will start downloading the files it requires for the scan (Note: It may take a couple of minutes) When download is complete, click on Local Disks to start the scan When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the Panda scan report, along with a new HijackThis Log.
here is the hijack and panda logs, i only got one spyware cookkie thx by he way, my comp is gettin faster. Incident Status Location Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt Logfile of HijackThis v1.99.1 Scan saved at 8:00:18 AM, on 5/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\HJT\HijackThis_v1.99.1.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)
Your log seems to be clean, but you haven't installed a firewall. I actually recommended to install a firewall because your computer gets infected very fast, if you don't install firewall.
