can anyone please help me with this W32.Myzor.FK@yf

Discussion in 'Windows - Virus and spyware problems' started by cpalmer5, Jul 10, 2006.

  1. cpalmer5

    cpalmer5 Member

    Joined:
    Jul 9, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    can somebody please help me get this bloody virus off my system.
    I would greatly appreciate any assistance.
    i have downloaded ewido, smitfraud and hijack this.


    Logfile of HijackThis v1.99.1
    Scan saved at 11:14:37 PM, on 7/10/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    C:\Program Files\McAfee.com\VSO\oasclnt.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\RTHDCPL.EXE
    c:\program files\mcafee.com\agent\mcdetect.exe
    C:\Program Files\Kazaa\kazaa.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\Program Files\BigFix\bigfix.exe
    C:\WINDOWS\system32\svchost.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\dcomcfg.exe
    C:\Program Files\TBONBin\tbon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\atmclk.exe
    c:\program files\mcafee.com\vso\mcmnhdlr.exe
    c:\program files\mcafee.com\shared\mghtml.exe
    C:\Documents and Settings\cujo\My Documents\HijackThis_v1.99.1.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
    O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
    O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\PROGRA~1\INSTAF~1\INSTAF~1.DLL (file missing)
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: Nothing - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp101.tmp
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-ca\msntb.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-ca\msntb.dll
    O3 - Toolbar: (no name) - {25D8BACF-3DE2-4B48-AE22-D659B8D835B0} - (no file)
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [McafWelcome] C:\Program Files\McAfee.com\Agent\mcwelcom.exe
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY
    O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
    O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
    O4 - HKLM\..\Run: [MPFEXE] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [!ewido] "C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKLM\..\RunOnce: [PM_reg] c:\windows\regedit.exe /s c:\sysprep\Nic_pm.reg
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
    O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\guard.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
     
    cpalmer5, Jul 10, 2006
    #1
  2. JaPK

    JaPK Regular member

    Joined:
    Feb 23, 2006
    Messages:
    1,269
    Likes Received:
    0
    Trophy Points:
    46
    Hi cpalmer5, this is definately a better place for logs than my shoutbox :D

    Download SmitfraudFix.zip to your desktop -> http://siri.urz.free.fr/Fix/SmitfraudFix.zip

    Unzip it (folder named SmitFraudFix) to your desktop:

    Open the folder SmitfraudFix and doubleclick smitfraudfix.cmd
    Choose option #1 - Search by typing 1 and pressing "Enter"; a textfile opens and lists the infected files (if those exist)

    Post the contents of this textfile to here.

    (Some antiviruses recognises process.exe as a malware. It is not malware, it is a program that stops processes)

    Then I or one of my fixer buddies will continue the cleaning process.
     
    JaPK, Jul 10, 2006
    #2
  3. cpalmer5

    cpalmer5 Member

    Joined:
    Jul 9, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    thank you so much for replying to my thread. here is what i got from smitfraud



    SmitFraudFix v2.68b

    Scan done at 20:13:03.75, Tue 07/11/2006
    Run from C:\DOCUME~1\cujo\LOCALS~1\Temp\SmitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    Fix ran in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    C:\WINDOWS\system32\dcomcfg.exe FOUND !
    C:\WINDOWS\system32\hp???.tmp FOUND !
    C:\WINDOWS\system32\hp????.tmp FOUND !
    C:\WINDOWS\system32\ld???.tmp FOUND !
    C:\WINDOWS\system32\ld????.tmp FOUND !
    C:\WINDOWS\system32\ot.ico FOUND !
    C:\WINDOWS\system32\regperf.exe FOUND !
    C:\WINDOWS\system32\stdole3.tlb FOUND !
    C:\WINDOWS\system32\ts.ico FOUND !
    C:\WINDOWS\system32\1024\ FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\cujo\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\cujo\FAVORI~1

    C:\DOCUME~1\cujo\FAVORI~1\Antivirus Test Online.url FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{af3fd9a8-1287-4159-9212-9a5b4494af70}"="ecosystems"

    [HKEY_CLASSES_ROOT\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32]
    @="C:\WINDOWS\system32\guxxa.dll"

    [HKEY_CURRENT_USER\Software\Classes\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32]
    @="C:\WINDOWS\system32\guxxa.dll"


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    cpalmer5, Jul 11, 2006
    #3
  4. Jurppis

    Jurppis Regular member

    Joined:
    Feb 22, 2006
    Messages:
    659
    Likes Received:
    0
    Trophy Points:
    26
    JaPK told me that I should continue (he's so lazy ;) )

    Uninstall these programs via add / remove programs in contol panel:

    RXToolBar
    Tbon or The Best Offers or anything related to those
    Kazaa <- Some versions of Kazaa contain spyware, it's recommended to uninstall this.


    Open HijackThis, do a system scan only and check these:

    O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\PROGRA~1\INSTAF~1\INSTAF~1.DLL (file missing)
    O3 - Toolbar: (no name) - {25D8BACF-3DE2-4B48-AE22-D659B8D835B0} - (no file)
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
    O4 - HKLM\..\RunOnce: [PM_reg] c:\windows\regedit.exe /s c:\sysprep\Nic_pm.reg
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
    O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)


    Close all other open windows and click fix cheked.

    Restart your computer to safe mode
    http://www.pchell.com/support/safemode.shtml

    Delete these folders in safe mode (if found):

    C:\Program Files\->TBONBin
    C:\Program Files\->RXToolBar
    C:\Program Files\->Kazaa <- recommended to delete but your choise
    C:\PROGRA~1\->INSTAF~1

    Then do a full system scan with Ewido in safe mode and save the scan results

    Next open SmitfraudFix folder and doubleclick the file smitfraudfix.cmd
    Choose option #2 - Clean by typing 2 and pressing "Enter" in order to remove the infected files.

    You are asked: "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove your desktop wallpaper and the infected registry keys.

    The tool checks if wininet.dll file is infected. You might be asked to replace the infected .dll (if found); answer "Yes" by typing Y and press "Enter".

    The tool might have to restart your computer; if it won't do it, restart your computer back to normal mode.
    A textfile will appear after the cleaning process, copy this file and paste it to here.

    Tha log is saved to your local diskdrive, usually C:\rapport.txt. Post also a new HijackThis log and the scan results from ewido.


     
    Jurppis, Jul 12, 2006
    #4
  5. cpalmer5

    cpalmer5 Member

    Joined:
    Jul 9, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    sorry i went on on vacation for the weekend, here are all of the scans you asked for.

    SmitFraudFix v2.68b

    Scan done at 16:31:00.37, Sun 07/16/2006
    Run from C:\DOCUME~1\cujo\LOCALS~1\Temp\SmitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    Fix ran in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{af3fd9a8-1287-4159-9212-9a5b4494af70}"="ecosystems"

    [HKEY_CLASSES_ROOT\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32]
    @="C:\WINDOWS\system32\guxxa.dll"

    [HKEY_CURRENT_USER\Software\Classes\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32]
    @="C:\WINDOWS\system32\guxxa.dll"


    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri

    C:\WINDOWS\system32\guxxa.dll -> Missing File


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\WINDOWS\system32\dcomcfg.exe Deleted
    C:\WINDOWS\system32\hp???.tmp Deleted
    C:\WINDOWS\system32\ld???.tmp Deleted
    C:\WINDOWS\system32\ot.ico Deleted
    C:\WINDOWS\system32\regperf.exe Deleted
    C:\WINDOWS\system32\simpole.tlb Deleted
    C:\WINDOWS\system32\stdole3.tlb Deleted
    C:\WINDOWS\system32\ts.ico Deleted
    C:\DOCUME~1\cujo\FAVORI~1\Antivirus Test Online.url Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End

    this one is a little long

    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 4:29:36 PM 7/16/2006

    + Scan result:



    C:\Program Files\Altnet -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\Program Files\Altnet\Download Manager -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\Program Files\Altnet\My Altnet Shares -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\Altnet -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\Altnet\Atl.dll -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\Altnet\DMinfo3.cab -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\Altnet\Setup.cab -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\Altnet\dminstall7.cab -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\Altnet\msvcirt.dll -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\Altnet\mysearch.cab -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\Altnet\pminstall.cab -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\kazaa_setup.exe -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Altnet -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Altnet\ADM -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Altnet\TopSearch -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\SigningModule.SigningModule -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\SigningModule.SigningModule.1 -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\SigningModule.SigningModule\CLSID -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\SigningModule.SigningModule\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\TopSearch.TSLink -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\TopSearch.TSLink.1 -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\TopSearch.TSLink\CLSID -> Adware.Altnet : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\TopSearch.TSLink\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_0_0_105300.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_0_0_106800.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_0_0_107400.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_1_0_449200.gif -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_1_0_449600.gif -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_1_0_454300.gif -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_2_0_105300.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_2_0_106800.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_2_0_107400.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_3_0_105300.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_3_0_106800.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_3_0_107400.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_4_0_111600.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_4_0_152400.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_4_0_155300.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\AdCache\B_329_4_0_164100.htm -> Adware.Cydoor : Cleaned with backup (quarantined).
    HKU\S-1-5-21-2610784121-1669237785-3153867619-1007\Software\Kazaa\Promotions\Cydoor -> Adware.Cydoor : Cleaned with backup (quarantined).
    HKU\S-1-5-21-2610784121-1669237785-3153867619-1007\Software\Kazaa\Promotions\Cydoor\Adwr_329 -> Adware.Cydoor : Cleaned with backup (quarantined).
    HKU\S-1-5-21-2610784121-1669237785-3153867619-1007\Software\Kazaa\Promotions\Cydoor\Adwr_329\Loct_4 -> Adware.Cydoor : Cleaned with backup (quarantined).
    HKU\S-1-5-21-2610784121-1669237785-3153867619-1007\Software\Kazaa\Promotions\Cydoor\Adwr_329\Services -> Adware.Cydoor : Cleaned with backup (quarantined).
    HKU\S-1-5-21-2610784121-1669237785-3153867619-1007\Software\Kazaa\Promotions\Cydoor\Adwr_329\Services\Queue -> Adware.Cydoor : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\instafink.INSTAFINK -> Adware.InstaFinder : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\instafink.INSTAFINK\Clsid -> Adware.InstaFinder : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10000-0x121a5443392ba651e819da3fa477ec31.sig -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10000-0x4be0cf57daf05bf43d27718ae7162368.sig -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10000-0x7f5ca253b385859d8f34a7077ee2842e.sig -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10000-0xb1d516e40f6a551b53d1207d8a66e0c6.sig -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10001-110.sig -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-1005-1020048.sig -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-5001-883060949.sig -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\Cache\Database\index256.dbb -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\P2P Networking\P2P Networking.eng -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\WebP2PInstaller.Installer -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\WebP2PInstaller.Installer.1 -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\WebP2PInstaller.Installer\CLSID -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\WebP2PInstaller.Installer\CurVer -> Adware.P2PNetworking : Cleaned with backup (quarantined).
    :mozilla.113:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.140:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.57:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.58:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.59:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.60:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.61:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.62:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.63:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Guest\Cookies\guest@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@sportingnews.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.47:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.48:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.49:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.50:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.29:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\cujo\Local Settings\Temp\Cookies\cujo@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\Guest\Cookies\guest@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : Cleaned.
    :mozilla.204:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.205:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.206:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.144:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.145:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.146:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.147:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.157:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
    :mozilla.68:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    C:\Documents and Settings\Guest\Cookies\guest@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.189:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.190:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.191:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.192:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.193:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.40:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.41:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.42:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.43:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.44:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.45:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@media.fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.160:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.198:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.199:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.200:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Guest\Cookies\guest@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Guest\Cookies\guest@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@ehg-adidas.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@ehg-ctv.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.116:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.101:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
    :mozilla.98:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
    :mozilla.110:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.111:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.112:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.115:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.64:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.65:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.66:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.67:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.46:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
    :mozilla.79:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.80:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.81:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.82:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@counter4.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
    :mozilla.155:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.156:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned.
    :mozilla.117:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\cujo\Local Settings\Temp\Cookies\cujo@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.83:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
    :mozilla.84:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
    :mozilla.85:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
    :mozilla.86:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
    :mozilla.87:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@xxxcounter[1].txt -> TrackingCookie.Xxxcounter : Cleaned.
    :mozilla.26:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.27:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Guest\Cookies\guest@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\cujo\Local Settings\Temp\Cookies\cujo@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.37:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.38:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.39:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    C:\WINDOWS\system32\1024 -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1098.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld12A9.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld12B8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld13AE.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1425.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld14FD.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1509.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1674.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld16E2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld17F6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld17FB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld180.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1969.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1991.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1A6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1AB7.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1C37.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1DB0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1DD0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld1E38.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld21A4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld21D6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2268.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld234D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld23EE.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld241F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld244A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2456.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld254B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2605.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2614.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld262.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2644.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2657.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld26B0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld27A2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld27FA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2859.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld29B3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2A3B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2A83.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2B6A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2D1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2D82.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2DE1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld2EEE.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld310F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3312.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3446.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld36B7.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld377.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld37BD.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld386A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld38B3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3972.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld397D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld39B4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3A7B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3B89.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3C13.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3DAE.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3EE.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3EE3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3F3D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3F8A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld3F9C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld4343.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld437A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld43AA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld4470.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld45E9.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld460A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld480D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld485C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld4907.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld498F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld49F8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld4A38.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld4A67.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld4BBB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld4C53.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld4E5E.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5027.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld531C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld53EC.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5510.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5753.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5767.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld57E6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld57FB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld58C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld59A1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld59D1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld59F4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5ADB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5B58.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5B5E.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5BB1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5C3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5CAA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5D82.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5DB9.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5EA8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld5FE2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6013.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6015.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6055.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6062.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld619D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld63A3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld64E0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6514.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6668.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6737.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld67CE.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld67E3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld685.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld68F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6A25.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6B26.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6B68.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6B70.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6C0B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6C71.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6DC3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6E24.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6E78.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6E9F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6EAB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld6FFC.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld700E.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld702F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7177.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7220.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7226.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld72A5.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7538.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld759D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld759E.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld769A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld76C4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7820.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld790D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld792E.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7935.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld79B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7A6D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7A70.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7AD1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7B1E.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7BFC.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7C9E.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7D62.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7D79.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7EA2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7F65.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7F70.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld7F7A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8049.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8073.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8088.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld81D6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8247.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8248.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8341.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8389.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld83FA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld848A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld86C5.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld876A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8880.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8A56.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8BD6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8C29.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8C2D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8C47.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8C4A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8EE8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8FA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld8FB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld902C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld90AA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld91B1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld92EF.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9479.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9485.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld962F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9764.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld97A1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9817.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld987.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld991F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9974.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9A57.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9BB4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9BE7.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9C39.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9C79.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9C7C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9D4A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9D66.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9DF4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9DFD.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9E3F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9E60.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9EB2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9F37.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9FBC.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ld9FC3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA182.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA21F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA2E2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA334.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA391.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA414.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA4B8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA54C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA58D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA641.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA69B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA6AF.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA706.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA75B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA7A6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA809.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA87D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA9CC.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldA9D0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAA88.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAAEA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAB35.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAE35.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAE8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAEAB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAEBA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAF8C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldAFE5.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB066.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB0A2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB0DF.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB146.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB216.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB258.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB395.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB3F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB489.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB57A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB5C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB78D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB792.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB86B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldB976.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBA19.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBAB6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBAD7.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBB03.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBC6F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBC87.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBCCA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBEF5.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBFB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldBFED.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC041.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC045.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC0BE.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC15B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC16D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC205.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC2A5.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC347.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC36C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC37B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC3BF.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC3C2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC3E9.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC57A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC61D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldC754.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCA82.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCAEC.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCB27.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCB49.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCC3C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCC7C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCCA0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCD2.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCE1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldCEFF.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD067.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD0E3.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD159.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD24.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD523.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD745.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD8CA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD8D0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldD99C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldDB10.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldDDE1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldDDED.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldDE77.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldDE8C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldDF00.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldDFB4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE00C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE028.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE150.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE185.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE1F5.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE367.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE368.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE559.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE593.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE63D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE69A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE8F8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldE9FA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldEBE7.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldEC87.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldECA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldECD.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldECEA.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldED9D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldEDBE.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldEEA8.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldEF9D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF085.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF0FC.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF3F4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF41F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF500.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF74A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF7B4.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF7F6.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF94C.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldF99D.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldFB55.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldFB70.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldFE09.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldFE67.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldFE93.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024\ldFF00.tmp -> Trojan.Small : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\\kernel32.dll -> Trojan.Small : Cleaned with backup (quarantined).


    ::Report end

    Logfile of HijackThis v1.99.1
    Scan saved at 4:49:30 PM, on 7/16/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\guard.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    C:\Program Files\McAfee.com\VSO\oasclnt.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
    C:\Program Files\Real\RealPlayer\trueplay.exe
    C:\Program Files\Real\RealPlayer\trueplay.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\Program Files\BigFix\bigfix.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\cujo\Desktop\HijackThis_v1.99.1.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
    O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
    O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-ca\msntb.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-ca\msntb.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [McafWelcome] C:\Program Files\McAfee.com\Agent\mcwelcom.exe
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
    O4 - HKLM\..\Run: [MPFEXE] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [!ewido] "C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
    O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\guard.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS



     
    cpalmer5, Jul 16, 2006
    #5
  6. JaPK

    JaPK Regular member

    Joined:
    Feb 23, 2006
    Messages:
    1,269
    Likes Received:
    0
    Trophy Points:
    46
    Ok, remove the old version of smitfraudfix from your computer and download the latest version from here -> http://siri.urz.free.fr/Fix/SmitfraudFix.zip

    Unzip it (folder named SmitFraudFix) to your desktop.

    Restart your computer to the safemode and choose your normal user account -> http://www.pchell.com/support/safemode.shtml

    When in safemode, open SmitfraudFix folder and doubleclick the file smitfraudfix.cmd
    Choose option #2 - Clean by typing 2 and pressing "Enter" in order to remove the infected files.

    You are asked: "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove your desktop wallpaper and the infected registry keys.

    The tool checks if wininet.dll file is infected. You might be asked to replace the infected .dll (if found); answer "Yes" by typing Y and press "Enter".

    The tool might have to restart your computer; if it won't do it, restart your computer back to normal mode.
    A textfile will appear after the cleaning process, copy this file and paste it to here.

    Tha log is saved to your local diskdrive, usually C:\rapport.txt.

    Warning : Running option 2 in a clean computer will delete your desktop wallpaper.

    Post a fresh HjT log and the contents of C:\rapport.txt.
     
    JaPK, Jul 16, 2006
    #6
  7. cpalmer5

    cpalmer5 Member

    Joined:
    Jul 9, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    thanks japk, this is what i got.

    SmitFraudFix v2.73

    Scan done at 11:41:23.31, Mon 07/17/2006
    Run from C:\Documents and Settings\cujo\Local Settings\Temp\SmitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    Fix ran in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End

    Logfile of HijackThis v1.99.1
    Scan saved at 11:52:13 AM, on 7/17/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\guard.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\Program Files\McAfee.com\VSO\oasclnt.exe
    C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\ewido.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\BigFix\bigfix.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\cujo\Desktop\HijackThis_v1.99.1.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
    O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
    O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-ca\msntb.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-ca\msntb.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [McafWelcome] C:\Program Files\McAfee.com\Agent\mcwelcom.exe
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
    O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
    O4 - HKLM\..\Run: [MPFEXE] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [!ewido] "C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
    O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Documents and Settings\cujo\Desktop\ewido\ewido anti-spyware 4.0\guard.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
    O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

     
    cpalmer5, Jul 17, 2006
    #7
  8. JaPK

    JaPK Regular member

    Joined:
    Feb 23, 2006
    Messages:
    1,269
    Likes Received:
    0
    Trophy Points:
    46
    Ok looks really good now :)

    Please run a one more scan with Ewido and quarantine the possible findings and save the log file. (follow my earlier instrctions)

    This is just because you had som much everything on your pc.

    When you're ready, post Ewido log to here.
     
    JaPK, Jul 17, 2006
    #8
  9. cpalmer5

    cpalmer5 Member

    Joined:
    Jul 9, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    Thanks a lot guys, i never thought my pc would be back to normal again.
    Everything seems fine. I wish i could shake your hand because you helped me a great deal. thanks again....Clayton

    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 3:49:05 PM 7/17/2006

    + Scan result:



    :mozilla.36:C:\Documents and Settings\cujo\Application Data\Mozilla\Firefox\Profiles\inl33h7v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\cujo\Cookies\cujo@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.


    ::Report end
     
    cpalmer5, Jul 17, 2006
    #9
  10. JaPK

    JaPK Regular member

    Joined:
    Feb 23, 2006
    Messages:
    1,269
    Likes Received:
    0
    Trophy Points:
    46
    Ok good, now you're clean :)

    Now you can empty Ewidos Quarantine:
    -> Open Ewido
    -> Select "Infections"
    -> Click "Select all"
    -> Click "Remove finally"
    -> Close Ewido

    You should update your Java (old version has all kinds of vulnerabilities)

    1. Click "Start"-> "Control panel" -> Double-click Java icon (coffee cup)
    2. Move to "Update" tab and update Java by clicking "Update Now". After that do a restart.
    3. If you can't make automatic update, get new version manually from here -> http://www.java.com/en/download/manual.jsp
    4. After updating, uninstall the old Java (if found) from Add/Remove Programs, named as
    J2SE Runtime Environment 5.0 Update 6

    Now that you're clean, here are some tips how to stay clean.

    -> Stand Up and Be Counted, Malware Complaints -> http://www.malwarecomplaints.info
    The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

    -> Clear your system restore -> http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx
    This will clear the system restore folders from possible malware that was left behind during the cleaning process. Remember to create a new restore point after the cleaning.

    -> Use CCleaner -> http://www.ccleaner.com
    Download and install CCleaner. Clean your registry and temporary files with it regularly.

    -> Use Ad-Aware -> http://www.bleepingcomputer.com/forums/?showtutorial=48
    Download and install Ad-Aware. Update it and scan your computer regularly with it.

    -> Use Ewido -> http://www.ewido.net/en
    Download and install Ewido. Update it and scan your computer regularly with it.

    -> Install SpywareBlaster -> http://www.javacoolsoftware.com/spywareblaster.html
    SpywareBlaster will prevent spyware from being installed to your computer.

    -> Install MVPS Hosts file -> http://mvps.org/winhelp2002/hosts.htm
    This prevents your computer from connecting to harmful sites.

    -> Change your browser to Firefox -> http://www.mozilla.org
    Firefox is faster, safer and quicker browser than Internet Explorer.

    -> Keep your systen up-to-date -> http://windowsupdate.microsoft.com
    Visit Windows Update regularly.

    -> Keep your antivirus and firewall up-to-date
    Scan your computer regularly with your antivirus.

    -> Read this article by TonyKlein -> http://castlecops.com/postlite7736-.html
    So how did I get infected in the first place?

    Stay clean ;)
     
    JaPK, Jul 18, 2006
    #10

Share This Page